CVE-2023-6434

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/sections_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

Score

CVSS 3.1 6.3 Medium

Status

Modified - cve-coordination@incibe.es

Published

2023-11-30

Last modified

2024-08-02

Weaknesses

CWE-79

Affected products

• Online Inventory Manager (Bigprof)
• Online Invoicing System (Bigprof)

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-xss-vulnerabilities-bigprof-products