# Exploit Title: PHPJabbers Car Rental v3.0 - Multiple Stored XSS
# Date: 19/11/2023
# Exploit Author: BugsBD Limited
# Discover by: Rahad Chowdhury
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/car-rental-script/
# Version: v3.0
# Tested on: Windows 10, Windows 11, Linux
# CVE-2023-48836
Descriptions:
PHPJabbers Car Rental v3.0 is vulnerable to Multiple Stored Cross-Site
Scripting. Multiple Stored XSS is a type of security vulnerability
that occurs when an application or website allows an attacker to
inject malicious scripts into the content that is permanently stored
on the server. Unlike reflected XSS, where the malicious script is
embedded in a URL and executed immediately, stored XSS involves the
persistent storage of the malicious script on the target server,
waiting for unsuspecting users to access the compromised content.
Steps to Reproduce:
1. Login your panel.
2. Vulnerable parameters are "name, plugin_sms_api_key,
plugin_sms_country_code, calendar_id, title, country name,
customer_name".
3. Go to System Menu then click SMS Settings.
4. Then use any XSS Payload in "SMS API Key", "Default Country Code"
input field and Save.
5. You will see popup.
## Reproduce:
[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-48836)