Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system

💥 BUG Stored xss via group name 💥 TESTED VERSION latest version as of 01/07/21 💥 STEP TO REPRODUCE 1. create a group with bellow xss payload in name.\ group1"'.\ 2. Now add a new user called user-B to the above group .\ 3. Finally visit...

Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system

✍️ Description There is a Stored XSS in the online invoicing system when adding a group name. 🕵️‍♂️ Proof of Concept Video POC: https://drive.google.com/file/d/13VaUfJrhd7m565lMQWZMfzXhfYPVjPV/view?usp=sharing Payload: ''' 💥 Impact Stored XSS...

Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system

✍️ Description There is a Stored XSS in the online invoicing system which could be exploited by any user who has permission to add a client. when a comment is added during the creation of a client by the user then due to improper sanitization XSS payload gets triggered. 🕵️‍♂️ Proof of Concept Video...

Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system

✍️ Description There is a Stored XSS in the online invoicing system which could be exploited by any user who has permission to add the invoice. when a comment is added during the creation of invoices by any user then due to improper sanitization XSS payload gets triggered. 🕵️‍♂️ Proof of Concept...

Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system

✍️ Description Stored xss bug using a xss payload in the full name field, other fields like address, city, state will work as well. 🕵️‍♂️ Proof of Concept Create a new user with the following payload " in one of the fields i mentioned above; full name, address etc... browse to you're profile and...

Cross-site Scripting (XSS) - Reflected in bigprof-software/online-invoicing-system

✍️ Description Application is vulnerable to XSS through key parameter. Line 85 of membershippasswordReset.php sends unvalidated data to a web browser, which can result in the browser executing malicious code. In this case the data is sent at builtinecho in membershippasswordReset.php at line 85...

WordPress Invoicing with InvoiceXpress for WooCommerce plugin <= 3.0.2 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Frank Liauw in WordPress Invoicing with InvoiceXpress for WooCommerce plugin versions = 3.0.2. Solution Update the WordPress Invoicing with InvoiceXpress for WooCommerce plugin to the latest available version at least...

CVE-2021-27839

A CSV injection vulnerability found in Online Invoicing System OIS 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or harmful websites, or disclosing other clients' details that the user did not have access to...

CVE-2021-27839

A CSV injection vulnerability found in Online Invoicing System OIS 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or harmful websites, or disclosing other clients' details that the user did not have access to...

Design/Logic Flaw

A CSV injection vulnerability found in Online Invoicing System OIS 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or harmful websites, or disclosing other clients' details that the user did not have access to...

CVE-2021-27839

A CSV injection vulnerability found in Online Invoicing System OIS 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or harmful websites, or disclosing other clients' details that the user did not have access to...

CVE-2021-27839

A CSV injection vulnerability found in Online Invoicing System OIS 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or harmful websites, or disclosing other clients' details that the user did not have access to...

CVE-2021-27839

CVE-2021-27839 describes a CSV injection vulnerability in Online Invoicing System (OIS) versions 4.3 and earlier. The issue allows authenticated users to inject data via CSV exports that could redirect admins to harmful sites or expose other clients’ data. Root cause is CSV injection in OIS’s exp...

CVE-2021-27839

A CSV injection vulnerability found in Online Invoicing System OIS 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or harmful websites, or disclosing other clients' details that the user did not have access to...

Online Invoicing System 注入漏洞

BigProf Online Invoicing System OIS is an online invoicing system. Online Invoicing System 4.3 suffers from an injection vulnerability that originates from CSV injection and can be exploited by an attacker to perform malicious actions...

PT-2021-17635

Name of the Vulnerable Software and Affected Versions: Online Invoicing System OIS versions 4.3 and below Description: A CSV injection issue allows users to perform malicious actions, such as redirecting admins to unknown or harmful websites, or disclosing other clients' details that the user did...

CVE-2021-27839: Improper Neutralization of Formula Elements in a CSV File

A CSV injection vulnerability found in Online Invoicing System OIS 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or harmful websites, or disclosing other clients' details that the user did not have access to...

CVE-2020-23518

Cross Site Scripting XSS vulnerability in UltimateKode Neo Billing - Accounting, Invoicing And CRM Software up to version 3.5 which allows remote attackers to inject arbitrary web script or HTML...

CVE-2020-23518

CVE-2020-23518 is a Cross Site Scripting (XSS) vulnerability in UltimateKode Neo Billing (Envato/Neo Billing) up to version 3.5. The issue allows remote attackers to inject arbitrary web script or HTML, with evidence of stored XSS in the Neo Billing 3.5 release via manipulated fields (e.g., Subje...

PT-2021-10904

Name of the Vulnerable Software and Affected Versions UltimateKode Neo Billing - Accounting, Invoicing And CRM Software versions up to 3.5 Description The issue allows remote attackers to inject arbitrary web script or HTML, due to a Cross Site Scripting XSS vulnerability. This enables attackers ...