CyberSec.Space Logo
Back to CVE Browser

CVE-2020-6583

MEDIUM
6.1
CVSS Severity Score
EPSS Score0.0860%
EPSS Percentile17.53th
PublishedJan 8, 2020
Last ModifiedNov 21, 2024

Vulnerability Description

BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session cookie from the administrator login, and take over the administrator account via the Name field in an Add New Client action.

Affected Platforms (CPE)

📦
Bigprof

Online Invoicing System

<= 2.6

References & Advisories

🔗 https://www.sevenlayers.com/index.php/282-online-invoicing-system-2-6-xss-session-hijack
🔗 https://www.sevenlayers.com/index.php/282-online-invoicing-system-2-6-xss-session-hijack

Related Vulnerabilities

CVE-2020-356749.8

BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordReset.php (t...

CVE-2020-356758.8

BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members acro...

CVE-2021-212607.6

Online Invoicing System (OIS) is open source software which is a lean invoicing system for small businesses, consultants and freel...

CVE-2020-356766.1

BigProf Online Invoicing System before 3.1 fails to correctly sanitize an XSS payload when a user registers using the self-registr...