PT-2023-32663
CVE-2023-6433
·
تاريخ النشر
2023-11-30
·
تاريخ التحديث
2023-12-02
الوصف من
CVSS 3.1
6.3
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions
BigProf Online Invoicing System version 2.6
Description
A vulnerability has been discovered in the BigProf Online Invoicing System, which does not sufficiently encode user-controlled input, resulting in persistent XSS through the "/inventory/suppliers view.php" API endpoint, in the
FirstRecord parameter. Exploitation of this issue could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.Recommendations
For BigProf Online Invoicing System version 2.6, consider disabling access to the "/inventory/suppliers view.php" endpoint or restricting the use of the
FirstRecord parameter until a patch is available.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾