Cross-site Scripting vulnerability in BigProf products

Vulnerability

The vulnerability is a persistent cross-site scripting (XSS) in BigProf Online Invoicing System version 2.6. It arises because the application does not properly sanitize user-controlled input in the FirstRecord parameter of /inventory/categories_view.php. An attacker can inject malicious JavaScript that is stored and executed when the page is loaded.

Exploitation

An attacker needs to have user-level access to the system to inject the payload via the FirstRecord parameter. No special network position is required as the application is typically web-facing. The attacker submits a crafted request with the payload, which gets stored and later triggered when an administrator or other user visits the affected page.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to information disclosure, session hijacking, or other client-side attacks. The CVSS score is 6.3 (Medium), with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L.

Mitigation

As of the publication date (2023-11-30), no fix or patch has been released by BigProf. Users are advised to implement input validation and output encoding as a workaround. No workaround details are provided in the reference [1].