40 matches found
Unrestricted file upload
Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1...
PT-2022-22882 · Unknown · Boxbilling
Name of the Vulnerable Software and Affected Versions: boxbilling/boxbilling version prior to 0.0.1 Description: The issue concerns an unrestricted upload of a file with a dangerous type. This problem is related to the GitHub repository boxbilling/boxbilling. Recommendations: For versions prior t...
CVE-2022-3552 Unrestricted Upload of File with Dangerous Type in boxbilling/boxbilling
Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1...
CVE-2022-3552 Unrestricted Upload of File with Dangerous Type in boxbilling/boxbilling
Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1...
CVE-2022-3552 Unrestricted Upload of File with Dangerous Type in boxbilling/boxbilling
Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1...
BoxBilling 代码问题漏洞
BoxBilling is open source billing and customer management software from the individual developers of BoxBilling. A security vulnerability exists in BoxBilling versions prior to 0.0.1 that stems from not restricting the upload of dangerous types of files...
BoxBilling <=4.22.1.5 - Authenticated Unrestricted File Upload - RCE
Description BoxBilling was vulnerable to Unrestricted File Upload. In order to exploit the vulnerability, an attacker must have a valid authenticated session as admin on the CMS. With at least 1 order of product an attacker can upload malicious file to hidden API endpoint that contain a webshell...
Cross-site Scripting (XSS) - Stored in boxbilling/boxbilling
Description Stored XSS at parameter 'iconurl' when Create New Product, New Category or New Addon Proof of Concept // PoC.req POST /BoxBilling/src/index.php?url=/api/admin/product/update HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:94.0 Gecko/20100101...
Cross-Site Request Forgery (CSRF) in boxbilling/boxbilling
✍️ Description CSRF on changing password of an admin account. There is no token or anti csrf implemented. 🕵️♂️ Proof of Concept Create a .html file poc.html for example and copy paste the following code in it. Change localhost to ur domain or ip address. javascript CSRF PoC send this file to a...
Cross-Site Request Forgery (CSRF) in boxbilling/boxbilling
✍️ Description CSRF BUG 🕵️♂️ Proof of Concept i see whole boxbilling software is vulnerable to csrf bug . There is no protection for csrf attack the csrf attack poc will be bellow code document.getElementById"myForm".submit In this html code change your sitename and save the file as html . Now...
Cross-site Scripting (XSS) - Generic in boxbilling/boxbilling
✍️ Description Cross site scripting via redirect url 🕵️♂️ Proof of Concept goto your boxbilling account and visit http://mysite.com/boxbilling/index.php?url=/bb-admin/extension/settings/redirect . here put xss paylaod xss"' in the redirect url field After saved you can see xss is executed Video...
Cross-site Scripting (XSS) - Generic in boxbilling/boxbilling
✍️ Description Xss via support ticket 🕵️♂️ Proof of Concept login into your boxbilling account and create support ticket . put bellow xss payload in support ticket click-me Now save the link and click the and see xss is executed Video Poc--...
Cross-site Scripting (XSS) - Generic in boxbilling/boxbilling
Overview Boxbilling is a free billing & client management software Affected versions of this software are vulnerable to Cross-site Scripting XSS. It is possible to inject JavaScript with object decoding such as alert1 resulting in XSS. Technical Description if we look in...
BoxBilling 4.20 Cross Site Scripting
======================================================================== | Title : BoxBilling 4.20 cross site scripting Exploits | Author : indoushka | email : [email protected] | Tested on : windows 8.1 FranASSais V.Pro | Version : 4.20 | Vendor :...
BoxBilling 3.6.11 (mod_notification) Stored Cross-Site Scripting Vulnerability
No description provided by source. ? BoxBilling 3.6.11 modnotification Stored Cross-Site Scripting Vulnerability Vendor: BoxBilling Product web page: http://www.boxbilling.com Affected version: 3.6.11 modnotification 1.0.0 Summary: BoxBilling is a free billing, invoicing & client management...
BoxBilling 3.6.11 Cross Site Scripting
BoxBilling 3.6.11 modnotification Stored Cross-Site Scripting Vulnerability Vendor: BoxBilling Product web page: http://www.boxbilling.com Affected version: 3.6.11 modnotification 1.0.0 Summary: BoxBilling is a free billing, invoicing & client management software. Desc: BoxBilling suffers from a...
BoxBilling 3.6.11 (mod_notification) Stored Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications BoxBilling 3.6.11 modnotification Stored Cross-Site Scripting Vulnerability Vendor: BoxBilling Product web page: http://www.boxbilling.com Affected version: 3.6.11 modnotification 1.0.0 Summary: BoxBilling is a free billing, invoicing & client...
BoxBilling 3.6.11 (mod_notification) Stored Cross-Site Scripting Vulnerability
Summary BoxBilling is a free billing, invoicing & client management software. Description BoxBilling suffers from a stored cross-site scripting vulnerability. Input passed to the 'message' POST parameter thru the 'Notification Center' extension/module is not properly sanitised before being return...
BoxBilling 3.6.11 - mod_notification Persistent Cross-Site Scripting
BoxBilling 3.6.11 - modnotification Persistent Cross-Site Scripting BoxBilling 3.6.11 modnotification Stored Cross-Site Scripting Vulnerability Vendor: BoxBilling Product web page: http://www.boxbilling.com Affected version: 3.6.11 modnotification 1.0.0 Summary: BoxBilling is a free billing,...
BoxBilling 3.6.11 - 'mod_notification' Persistent Cross-Site Scripting
BoxBilling 3.6.11 modnotification Stored Cross-Site Scripting Vulnerability Vendor: BoxBilling Product web page: http://www.boxbilling.com Affected version: 3.6.11 modnotification 1.0.0 Summary: BoxBilling is a free billing, invoicing & client management software. Desc: BoxBilling suffers from a...