CVE-2020-6583

Name of the Vulnerable Software and Affected Versions BigProf Online Invoicing System (OIS) versions through 2.6

Description The issue allows for session hijacking through an XSS vulnerability. An attacker can exploit this to retrieve the session cookie from the administrator login and take over the administrator account. This is achieved via the Name field in an Add New Client action.

Recommendations For versions through 2.6, update to a version that includes a fix for this issue to prevent session hijacking. As a temporary workaround, consider restricting access to the Add New Client action to minimize the risk of exploitation. Avoid using the Name field in the affected action until the issue is resolved.