PT-2020-17387 · Bigprof · Bigprof Online Invoicing System

Mqt · Published 2020-12-24 · Updated 2021-07-21 · CVE-2020-35677

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BigProf Online Invoicing System versions prior to 4.0

Description The issue arises from inadequate sanitization of fields for HTML characters when an administrator creates a new group using the "admin/pageEditGroup.php" endpoint, resulting in Stored XSS. Although an attacker would need administrative privileges to create the payload, the lack of CSRF protection on the endpoint responsible for creating the group poses a significant risk.

Recommendations For versions prior to 4.0, update to version 4.0 or later to resolve the issue. As a temporary workaround, consider implementing CSRF protection on the "admin/pageEditGroup.php" endpoint and ensuring proper sanitization of fields for HTML characters to prevent Stored XSS attacks. Restrict access to the "admin/pageEditGroup.php" endpoint to minimize the risk of exploitation.

Fix

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

CVE-2020-35677

Affected Products

Bigprof Online Invoicing System

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-35677 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35677 · Vendor Advisory
• https://labs.ingredous.com/2020/07/13/ois-groupedit-xss · Note
• https://t.me/cibsecurity/21260 · Telegram Post
• https://t.me/cvenotify/7689 · Telegram Post