Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to create a new group, resulting in Stored XSS. The caveat here is that an attacker would need administrative privileges in order to create the payload. One might think this completely mitigates the privilege-escalation impact as there is only one high-privileged role. However, it was discovered that the endpoint responsible for creating the group lacks CSRF protection.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
BigProf Online Invoicing System 跨站脚本漏洞
Vulnerability Description
BigProf Online Invoicing System（OIS）是一套在线发票系统。 BigProf Online Invoicing System 4.0 之前版本存在跨站脚本漏洞，该漏洞源于无法充分清理HTML字符的字段，管理员使用admin pageEditGroup.php创建一个新的组，导致存储XSS。这里需要注意的是，攻击者可利用该漏洞需要管理权限才能创建有效负载。
CVSS Information
N/A
Vulnerability Type
N/A