CVE-2018-11090

Vulnerability

An XSS vulnerability exists in ProxyPage.aspx of MyBiz MyProcureNet version 5.0.0. The issue allows an attacker to inject malicious client-side scripting. Exploitation requires an authenticated session, but registration for the application is typically open to anyone [1].

Exploitation

An attacker must first obtain a valid authenticated session (registration is open). The attacker then crafts a malicious URL or input to ProxyPage.aspx containing the XSS payload. When a victim user visits the manipulated page, the script executes in their browser [1].

Impact

Successful exploitation enables the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim [1].

Mitigation

The vendor did not respond to inquiries since February 2018, and no patch or workaround has been released. SEC Consult recommends not using this product until a thorough security review has been performed and all identified issues are resolved [1].