CVE-2023-6426

Name of the Vulnerable Software and Affected Versions BigProf Online Invoicing System version 2.6

Description A vulnerability has been discovered in the BigProf Online Invoicing System, which does not sufficiently encode user-controlled input, resulting in persistent XSS through the "/invoicing/app/invoices view.php" API endpoint, in the FirstRecord parameter. Exploitation of this issue could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

Recommendations For BigProf Online Invoicing System version 2.6, as a temporary workaround, consider disabling the /invoicing/app/invoices view.php endpoint or restricting the use of the FirstRecord parameter until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.