Lucene search

GoogleOSV:CVE-2023-6435

HistoryNov 30, 2023 - 2:15 p.m.

CVE-2023-6435

2023-11-3014:15:23

Google

osv.dev

vulnerability

bigprof online invoicing system 2.6

user input

persistent xss

exploitation

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

AI Score

5.9

Confidence

High

EPSS

Percentile

14.0%

JSON

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/batches_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-xss-vulnerabilities-bigprof-products