CVE-2023-51313
📋 TL;DR
PHPJabbers Restaurant Booking System v3.0 has a CSV injection vulnerability that allows attackers to execute arbitrary code on the server. The vulnerability occurs when insufficient input validation in the Languages section allows malicious data to be included in exported CSV files. This affects all installations of the vulnerable version.
💻 Affected Systems
- PHPJabbers Restaurant Booking System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing remote code execution, data theft, and complete system control.
Likely Case
Data exfiltration, privilege escalation, and potential lateral movement within the network.
If Mitigated
Limited impact with proper input validation and CSV sanitization in place.
🎯 Exploit Status
Exploitation requires access to the admin interface or compromised credentials. The vulnerability is in CSV export functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.1 or later
Vendor Advisory: https://www.phpjabbers.com/restaurant-booking-system/
Restart Required: No
Instructions:
1. Download latest version from PHPJabbers website. 2. Backup current installation. 3. Replace vulnerable files with patched version. 4. Test functionality.
🔧 Temporary Workarounds
Input Validation Sanitization
allAdd input validation to sanitize CSV export data in the Languages section
Modify PHP code to escape special characters in CSV exports
Implement whitelist validation for label parameters
🧯 If You Can't Patch
- Disable CSV export functionality in System Options
- Implement web application firewall rules to block malicious CSV payloads
🔍 How to Verify
Check if Vulnerable:
Check if running v3.0 and test CSV export from Languages section with payloads like =cmd|' /C calc'!A0Check Version:
Check admin panel or readme.txt file for version informationVerify Fix Applied:
Test CSV export functionality with malicious payloads after patching to ensure they are sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual CSV export requests
- Admin panel access with malicious payloads in parameters
Network Indicators:
- CSV downloads containing formula injection payloads
- Unusual outbound connections after CSV exports
SIEM Query:
source="web_logs" AND (uri="/admin/export_csv" OR uri="/admin/languages") AND (payload="=" OR payload="+" OR payload="-" OR payload="@")