cbcvebase.
CVE-2023-40748
published 2023-08-28

CVE-2023-40748: PHPJabbers Food Delivery Script 3.0 has a SQL injection (SQLi) vulnerability in the "q" parameter of index.php.

PriorityP274critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
2.90%
85.2th percentile
PHPJabbers Food Delivery Script 3.0 has a SQL injection (SQLi) vulnerability in the "q" parameter of index.php.

Affected

1 ranges
VendorProductVersion rangeFixed in
phpjabbersfood_delivery_script——

Detection & IOCsextracted from sources · hover to see the quote

url/index.php?controller=pjAdminOrders%26action%3dpjActionGetNewOrder%26column%3dcreated%26direction%3dASC%26page%3d1%26rowCount%3d50%26q%3d-1910%27)+OR+6100%3d6100%23%26type%3d↗
otherq=-1910')+OR+6100=6100#↗
  • →Detect exploitation attempts by matching POST requests to /index.php containing the 'q' parameter with SQL injection payloads (e.g., single-quote followed by boolean OR logic and comment terminator '#'). ↗
  • →Alert on HTTP 200 responses to /index.php (controller=pjAdminOrders, action=pjActionGetNewOrder) whose body contains both 'class pjAdminOrdersaction' and 'didn't exists' — these strings confirm successful SQLi exploitation. ↗
  • →Use Shodan query html:"PHPJabbers" to identify internet-exposed PHPJabbers Food Delivery Script instances for proactive asset discovery. ↗
  • →The vulnerability is unauthenticated (PR:N, UI:N) and exploited via a single POST request; monitor for anomalous POST traffic to index.php with URL-encoded SQL metacharacters in the 'q' parameter. ↗
  • ·The nuclei template uses a single POST request (max-request: 1) targeting a specific controller/action path; detection coverage is limited to this exact exploitation pattern and may miss variant payloads. ↗
  • ·Exploitation is confirmed only against version 3.0 of PHPJabbers Food Delivery Script; other versions are not confirmed vulnerable by the available sources. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.