PHPJabbers Restaurant Booking System HTML Injection Vulnerability

A vulnerability allowing multiple HTML injection points has been identified in PHPJabbers Restaurant Booking System version 3.0. This issue arises in the 'name', 'plugin_sms_api_key', 'plugin_sms_country_code', and 'title' parameters. The vulnerability can be exploited by injecting malicious HTML that is then executed when the content is viewed, potentially leading to cross-site scripting (XSS) attacks.

Impact

Exploitation of this vulnerability allows for cross-site scripting (XSS) attacks, where injected HTML or scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, log into the admin panel and navigate to the 'System Menu', then click on 'SMS Settings'. Inject any HTML tag into the 'SMS API Key' or 'Default Country Code' input fields and save the changes. The injected HTML will be executed, demonstrating the injection vulnerability.