PT-2019-14630 · Nch · Nch Express Accounts Accounting

Published 2019-10-17 · Updated 2019-10-21 · CVE-2019-16330

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NCH Express Accounts Accounting version 7.02

Description The issue concerns a persistent cross-site scripting (XSS) flaw in the input fields for Invoices, Sales Orders, Items, Customers, and Quotes. An authenticated, unprivileged user can modify these fields to inject arbitrary JavaScript code.

Recommendations For NCH Express Accounts Accounting version 7.02, consider restricting access to the input fields for Invoices, Sales Orders, Items, Customers, and Quotes to prevent arbitrary JavaScript injection until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-16330

Affected Products

Nch Express Accounts Accounting

References · 3

• 🔥 https://exploit-db.com/exploits/47505 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-16330 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16330 · Vendor Advisory