CVE-2023-43147

Vendor: PHPJabbers Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/limo-booking-software Version: 1.0 Tested on: Windows 10 Pro Impact: Add an attacker user with admin privileges CVE:

Cross Site Request Forgery vulnerability in limo-booking-software allows a remote attacker to execute add and user with admin privileges

POC 1 - Make an file with with this CODE and SAVE in HTML . If you save a new request to make a CSRF be sure that you change role_id=0 to 1 (role_id=1)

2 - Example test.html

3 - Send to the victim

4 - When the victim open the html the file test.html will open in his navigator and when he will open and press click at the button the code will changes in his actually session and one user will add in the panel admin with admin privileges.