CVE-2023-51293
📋 TL;DR
This vulnerability allows attackers to send excessive password reset or email change requests to legitimate users, potentially causing email denial-of-service. Attackers can flood user inboxes with emails, disrupting legitimate communications. All installations of PHPJabbers Event Booking Calendar v4.0 are affected.
💻 Affected Systems
- PHPJabbers Event Booking Calendar
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete email service disruption for targeted users, overwhelming mail servers with spam, and potential collateral damage to email infrastructure.
Likely Case
Targeted users receive hundreds of unwanted emails, causing inbox overflow and disrupting legitimate communications.
If Mitigated
Minimal impact with proper rate limiting and email filtering in place.
🎯 Exploit Status
Exploitation requires no authentication and can be performed via simple HTTP requests to the vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v4.0+ (check vendor for specific patched version)
Vendor Advisory: https://www.phpjabbers.com/event-booking-calendar/
Restart Required: No
Instructions:
1. Check vendor website for updated version. 2. Backup current installation. 3. Replace vulnerable files with patched version. 4. Verify functionality.
🔧 Temporary Workarounds
Implement Web Application Firewall (WAF) Rules
allConfigure WAF to rate limit requests to /index.php?controller=pjUser&action=pjActionForgot and email-related endpoints
Modify Application Code
allAdd rate limiting logic to forgot password and email settings functions in PHP code
🧯 If You Can't Patch
- Implement network-level rate limiting at firewall or load balancer
- Configure email server to limit messages per recipient from application IP
🔍 How to Verify
Check if Vulnerable:
Check if running PHPJabbers Event Booking Calendar v4.0 by examining version in admin panel or source codeCheck Version:
Check admin panel or examine includes/config.inc.php for version informationVerify Fix Applied:
Test forgot password functionality with rapid requests - should block after reasonable limit📡 Detection & Monitoring
Log Indicators:
- Multiple rapid POST requests to forgot password endpoint from single IP
- Unusual spike in email sending from application
Network Indicators:
- High volume of HTTP POST requests to /index.php?controller=pjUser&action=pjActionForgot
- Abnormal SMTP traffic from application server
SIEM Query:
source="web_logs" AND uri="/index.php?controller=pjUser&action=pjActionForgot" AND count by src_ip > 10 per minute