Cross-site Scripting vulnerability in BigProf products

Vulnerability

BigProf Online Invoicing System version 2.6 does not sufficiently encode user-controlled input, leading to persistent cross-site scripting (XSS) in the /inventory/items_view.php page via the FirstRecord parameter [1]. This vulnerability is part of a set of 14 XSS issues discovered by Rafael Pedrero across multiple BigProf products [1].

Exploitation

An attacker with network access can inject a malicious JavaScript payload into the FirstRecord parameter. The payload is stored on the system and executed when any user loads the affected page. No authentication is required to trigger the stored XSS, but user interaction (viewing the page) is necessary for execution [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, defacement, or theft of sensitive data. The CVSS v3.1 base score is 6.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L [1].

Mitigation

As of the publication date (2023-11-30), no official fix or patch has been released by BigProf [1]. Users should monitor for updates and consider applying input validation or output encoding as a workaround. The product is open source, so custom patches may be possible.