Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-systemValid
Reported on Jul 4th 2021
In the repo online invoicing system i found a stored xss which gets exploited on unpaid invoice view which is lead by client name.
🕵️♂️ Proof of Concept
Video POC: https://drive.google.com/file/d/1e_mTPPkSgGXM6XllelCrsdTYhhXMGCGb/view?usp=sharing Steps to reproduce: 1. Add a client with name xss"'><img src=x onerror=alert(1111)> 2. Save and then go to unpaid invoices. 3. Add a unpaid invoice and select the client we added before. 4. Save and you will see XSS pop-up
This vulnerability is capable of Stored XSS