PT-2019-14611 · Nch · Nch Express Invoice

Published 2019-10-14 · Updated 2019-10-16 · CVE-2019-16282

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NCH Express Invoice version 7.12

Description The issue concerns a persistent cross-site scripting (XSS) flaw. This flaw can be exploited via the input fields for Invoices, Items, Customers, and Quotes. An authenticated, unprivileged user can modify these fields to inject arbitrary JavaScript code.

Recommendations For NCH Express Invoice version 7.12, consider restricting access to the input fields for Invoices, Items, Customers, and Quotes to prevent arbitrary JavaScript injection until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-16282

Affected Products

Nch Express Invoice

References · 3

• 🔥 https://exploit-db.com/exploits/47496 · Exploit
• https://osv.dev/vulnerability/CVE-2019-16282 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16282 · Security Note