Authored by Hasan Ali YILDIR

PHPJabbers Vacation Rental Script version 4.0 suffers from a cross site request forgery vulnerability.

# Exploit Title: PHPJabbers Vacation Rental Script 4.0 - CSRF
# Date: 05/08/2023
# Exploit Author: Hasan Ali YILDIR
# Vendor Homepage:
# Software Link:
# Version: 4.0
# Tested on: Windows 10 Pro

## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials

Technical Detail / POC


1. Login Account
2. Go to Property Page (https://website/index.php?controller=pjAdminListings&action=pjActionUpdate)
3. Edit Any Property (https://website/index.php?controller=pjAdminListings&action=pjActionUpdate&id=21)

[1] Cross-Site Request Forgery


[2] Cross-Site Scripting (XSS)