PT-2023-32660 · Unknown · Bigprof Online Invoicing System

Rafael Pedrero · Publicado 2023-11-30 · Atualizado 2023-12-02 · CVE-2023-6430

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions BigProf Online Invoicing System version 2.6

Description A vulnerability has been discovered in the BigProf Online Invoicing System, which does not sufficiently encode user-controlled input, resulting in persistent XSS through the "/inventory/transactions view.php" API endpoint, in the FirstRecord parameter. Exploitation of this issue could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

Recommendations For BigProf Online Invoicing System version 2.6, consider disabling the /inventory/transactions view.php endpoint or restricting access to the FirstRecord parameter until a patch is available. As a temporary workaround, avoid using the FirstRecord parameter in the affected API endpoint until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-6430

Produtos afetados

Bigprof Online Invoicing System

Referências · 5

• https://incibe.es/en/incibe-cert/notices/aviso/multiple-xss-vulnerabilities-bigprof-products · Nota
• https://twitter.com/CVEnew/status/1730228869024616543 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-6430 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-6430 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1730251475769528328 · Publicação no Twitter