CVE-2026-6623

Vulnerability

Overview

CVE-2026-6623 is a stored cross-site scripting (XSS) vulnerability in BichitroGan ISP Billing Software version 2025.3.20. The flaw resides in the profile page handler, specifically the fullname parameter processed by the endpoint /accounts/profile (edit-profile-post) and rendered in /?_route=settings/users-view/{id}. User-supplied input is stored in the database and later displayed without proper output encoding, allowing injection of arbitrary JavaScript [1].

Exploitation

An attacker must first authenticate as a normal user. By navigating to the profile edit page and setting the fullname field to a malicious payload (e.g., ``), the script is stored. When any user—including an administrator—views the affected profile page or the admin user list, the payload executes in their browser. No special network position is required beyond remote access to the application [1].

Impact

Successful exploitation enables session hijacking, credential theft, and unauthorized actions within the context of the victim's session. The reference notes that this XSS can be chained with an IDOR vulnerability (CVE-2026-5031) to force an admin to view the attacker's profile, leading to privilege escalation and potential full system compromise [1].

Mitigation

The vendor was contacted but did not respond, and no official patch has been released. As a workaround, administrators should escape output using htmlspecialchars($user['fullname'], ENT_QUOTES, 'UTF-8') and validate input to restrict special characters. Implementing output encoding in all templates is also recommended [1].