[*] :: Title: Express Invoice - The Complete Billing Software v7.0 Stored XSS Injection [*] :: Author: QUIXSS [*] :: Date: 2019-04-23 [*] :: Software: Express Invoice - The Complete Billing Software v7.0 [?] :: Technical Details & Description: # Weak security measures like no input fields data filtering has been discovered in the «Express Invoice - The Complete Billing Software». Current version of this web-application is 7.0. [?] :: Demo Website: # https://codecanyon.net/item/express-invoice-with-stock-account-solutions/15467114 # Backend: http://billing.ultimatekode.com/demo/ # Login: admin, Password: 123456 [!] :: PoC Stored XSS Injection: # http://billing.ultimatekode.com/demo/ [+] :: PoC [Stored XSS Injection]: # Authorize on the demo website for tests: http://billing.ultimatekode.com/demo/ (login / password is admin / 123456). This web-application have no security measures or filters to prevent XSS Injections, so you can do what u want and add your payload almost in each input field you see. No limits :) # Sample payload: "><script>alert('QUIXSS')</script>