PT-2012-5666 · Simple Invoices · Simple Invoices

Published 2012-12-28 · Updated 2013-10-11 · CVE-2012-4932

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SimpleInvoices versions prior to stable-2012-1-CIS3000

Description The issue allows remote attackers to inject arbitrary web script or HTML via various fields and parameters, including the having parameter in a manage action to "index.php", the Email field in an Add User action, and multiple fields in Add Customer, Add Biller, Add Invoice, Process Payment, Payment Types, Invoice Preferences, Manage Products, and Tax Rates actions.

Recommendations For SimpleInvoices versions prior to stable-2012-1-CIS3000, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the affected fields and parameters, such as the having parameter, Email field, Customer Name field, and others, until a patch is available. Avoid using these fields in the affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-4932

Affected Products

Simple Invoices

References · 3

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-12/0074.html · Exploit
• 🔥 https://exploit-db.com/exploits/38115 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-4932 · Security Note