CVEs-PoC/2014/CVE-2014-10001.md

CVE-2014-10001

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Appointment Scheduler 2.0 allow remote attackers to hijack the authentication of administrators for requests that (1) conduct cross-site scripting (XSS) attacks via the i18n[1][name] parameter in a pjActionCreate action to the pjAdminServices controller or (2) add an administrator via a pjActionCreate action to the pjAdminUsers controller.

POC

Reference

• http://packetstormsecurity.com/files/124755

Github

No PoCs found on GitHub currently.