CVE-2023-51333
📋 TL;DR
PHPJabbers Cinema Booking System v1.0 has a CSV injection vulnerability that allows attackers to execute arbitrary code on the server. This affects administrators who can access the System Options Languages section. Attackers can craft malicious CSV content that gets executed when exported.
💻 Affected Systems
- PHPJabbers Cinema Booking System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Limited code execution within web application context, potentially allowing file system access, database manipulation, or further exploitation.
If Mitigated
No impact if proper input validation and output encoding are implemented, or if the vulnerable feature is disabled.
🎯 Exploit Status
Exploit requires authenticated admin access. Public proof-of-concept demonstrates CSV injection technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.1 or later
Vendor Advisory: https://www.phpjabbers.com/cinema-booking-system/
Restart Required: No
Instructions:
1. Download latest version from PHPJabbers website. 2. Backup current installation. 3. Replace vulnerable files with patched version. 4. Verify CSV export functionality works without code injection.
🔧 Temporary Workarounds
Disable CSV Export
allRemove or restrict access to CSV export functionality in System Options Languages section.
Input Validation
allImplement server-side validation to sanitize CSV content and prevent formula injection.
🧯 If You Can't Patch
- Restrict admin access to trusted IP addresses only
- Implement web application firewall rules to block CSV formula injection patterns
🔍 How to Verify
Check if Vulnerable:
Test CSV export from System Options Languages section with payload like =cmd|' /C calc'!A0Check Version:
Check version in admin panel or readme.txt fileVerify Fix Applied:
Attempt CSV injection with test payloads and verify they are properly sanitized or rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual CSV export activity
- Admin panel access from unexpected IPs
- System command execution in web logs
Network Indicators:
- HTTP POST requests to CSV export endpoints with formula-like payloads
SIEM Query:
web_requests WHERE url_path CONTAINS 'csv' AND request_body CONTAINS '=cmd' OR request_body CONTAINS '=HYPERLINK'