PT-2023-32659 · Unknown · Bigprof Online Invoicing System

Rafael Pedrero · Published 2023-11-30 · Updated 2023-12-02 · CVE-2023-6429

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions BigProf Online Invoicing System version 2.6

Description A vulnerability has been discovered in the system, which does not sufficiently encode user-controlled input, resulting in persistent XSS through the "/invoicing/app/clients view.php" endpoint, in the FirstRecord parameter. This could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

Recommendations For BigProf Online Invoicing System version 2.6, consider disabling the /invoicing/app/clients view.php endpoint or restricting access to the FirstRecord parameter until a patch is available. Additionally, avoid using the FirstRecord parameter in the affected endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-6429

Affected Products

Bigprof Online Invoicing System

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-6429 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6429 · Vendor Advisory
• https://twitter.com/CVEnew/status/1730228872862441788 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-xss-vulnerabilities-bigprof-products · Note