CVE-2023-43147

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery (CSRF) to add an admin user via the Add Users Function, aka an index.php?controller=pjAdminUsers&action=pjActionCreate URI.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/MinoTauro2020/CVE-2023-43147/Exploit, Third Party Advisory
https://github.com/MinoTauro2020/CVE-2023-43147/Exploit, Third Party Advisory

Timeline

Published: Oct 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-431488.1SPA-Cart 1.9.0.3 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to delete all accounts.CVE-2023-431498.8SPA-Cart 1.9.0.3 is vulnerable to Cross Site Request Forgery (CSRF) that allows a remote attacker to add an admin user with role status.CVE-2023-43156.1The Woo Custom Emails for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wcemails_edit' parameter in versions up to, and CVE-2023-431549.8In Macrob7 Macs Framework Content Management System (CMS) 1.1.4f, loose comparison in "isValidLogin()" function during login attempt results CVE-2023-43167.5Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.CVE-2023-43174.3An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3 CVE-2023-431768.8A deserialization vulnerability in Afterlogic Aurora Files v9.7.3 allows attackers to execute arbitrary code via supplying a crafted .sabred CVE-2023-431779.8CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.CVE-2023-43184.3The Herd Effects WordPress plugin before 5.2.4 does not have CSRF when deleting its items, which could allow attackers to make logged in adm CVE-2023-431838.8Incorrect access control in Reprise License Management Software Reprise License Manager v15.1 allows read-only users to arbitrarily change t CVE-2023-431879.8A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers CVE-2023-431915.4SpringbootCMS 1.0 foreground message can be embedded malicious code saved in the database. When users browse the comments, these malicious c