PT-2020-19172 · Bigprof · Bigprof Online Invoicing System

Published 2020-01-08 · Updated 2020-01-17 · CVE-2020-6583

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BigProf Online Invoicing System (OIS) versions through 2.6

Description The issue allows for session hijacking through an XSS vulnerability. An attacker can exploit this to retrieve the session cookie from the administrator login and take over the administrator account. This is achieved via the Name field in an Add New Client action.

Recommendations For versions through 2.6, update to a version that includes a fix for this issue to prevent session hijacking. As a temporary workaround, consider restricting access to the Add New Client action to minimize the risk of exploitation. Avoid using the Name field in the affected action until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-6583

Affected Products

Bigprof Online Invoicing System

References · 3

• 🔥 https://sevenlayers.com/index.php/282-online-invoicing-system-2-6-xss-session-hijack · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-6583 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6583 · Vendor Advisory