Simple Invoices HTML-injection and Cross-Site Scripting Vulnerability

vendor:

Simple Invoices

by:

SecurityFocus

8,8

CVSS

HIGH

HTML-injection and Cross-Site Scripting

CWE

Product Name: Simple Invoices

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

Simple Invoices HTML-injection and Cross-Site Scripting Vulnerability

Simple Invoices is prone to multiple HTML-injection vulnerabilities and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. This allows an attacker to inject malicious HTML and script code into the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user.

Mitigation:

Input validation should be used to ensure that user-supplied input is properly sanitized before being used in dynamically generated content.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/56882/info

Simple Invoices is prone to multiple HTML-injection vulnerabilities and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. 

[http://]www.example.com/simpleinvoices/index.php?module=invoices&view=manage&having=%3C/script%3E%3Cscript%3Ealert%28%27POC%20XSS%27%29;%3C/script%3E%3Cscript%3E