CVE-2026-6624

Vulnerability

Overview A stored cross-site scripting (XSS) vulnerability exists in BichitroGan ISP Billing Software version 2025.3.20. The Pool Name parameter in the /?_route=pool/add endpoint is not properly sanitized before being stored in the database. When the stored value is later rendered in the Pool List interface, it is displayed without HTML encoding, allowing arbitrary JavaScript execution. The vendor was contacted but did not respond, and an exploit has been publicly released [1].

Exploitation

Requirements Exploitation requires authenticated access to the pool management interface, specifically the ability to create or modify pool entries. An attacker with such privileges can inject a malicious payload into the Pool Name field, such as ``. The payload is then stored and executed whenever an administrator views the Pool List page. Remote attackers can target internal administrators via social engineering or privilege escalation [1].

Impact

Successful exploitation leads to cross-site scripting execution in the administrator's browser context. This enables session hijacking, credential theft, defacement, and unauthorized actions on the billing system. If an admin account is compromised, an attacker could achieve full system takeover [1].

Mitigation

No official patch is available. Mitigation includes proper output escaping (e.g., htmlspecialchars with ENT_QUOTES), strict input validation, and Content Security Policy (CSP) headers. Administrators should restrict access to the pool management interface and monitor for suspicious activity [1].