PT-2021-17635 · Unknown · Online Invoicing System

Jinson Varghese Behanan · Published 2021-03-03 · Updated 2021-03-10 · CVE-2021-27839

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Online Invoicing System (OIS) versions 4.3 and below

Description: A CSV injection issue allows users to perform malicious actions, such as redirecting admins to unknown or harmful websites, or disclosing other clients' details that the user did not have access to.

Recommendations: For versions 4.3 and below, update to a version above 4.3 to resolve the issue. As a temporary workaround, consider restricting access to sensitive client details and implementing additional security measures to prevent redirection to harmful websites.

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2021-27839

Affected Products

Online Invoicing System

References · 8

• https://osv.dev/vulnerability/CVE-2021-27839 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27839 · Security Note
• https://github.com/bigprof-software/online-invoicing-system/releases/tag/4.4 · Note
• https://t.me/cvenotify/11116 · Telegram Post
• https://t.me/cvenotify/10824 · Telegram Post
• https://t.me/cvenotify/10868 · Telegram Post
• https://t.me/cibsecurity/24426 · Telegram Post
• https://jinsonvarghese.com/csv-injection-in-online-invoicing-system · Note