diff --git a/bounties/other/online-invoicing-system/1/README.md b/bounties/other/online-invoicing-system/1/README.md new file mode 100644 index 0000000000..85e6f430b4 --- /dev/null +++ b/bounties/other/online-invoicing-system/1/README.md @@ -0,0 +1,12 @@ +# Description + +`online-invoicing-system` is vulnerable to `Cross-Site Scripting (XSS)`. + +# Steps To Reproduce + +1. Go to https://bigprof.com/appgini/applications/online-invoicing-system +2. click on Launch private demo on Gitpod https://gitpod.io/#https://github.com/bigprof-software/online-invoicing-system +3. login using appgini in all the fields and click on 3rd option "go to admin homepage...." +4. select total groups and click on edit button for anonymous +5. Edit the description with `aaaaa"` and save +6. XSS will be triggered. And when u visit the grops. diff --git a/bounties/other/online-invoicing-system/1/vulnerability.json b/bounties/other/online-invoicing-system/1/vulnerability.json new file mode 100644 index 0000000000..a2c0ad9b41 --- /dev/null +++ b/bounties/other/online-invoicing-system/1/vulnerability.json @@ -0,0 +1,57 @@ +{ + "PackageVulnerabilityID": "1", + "DisclosureDate": "2021-02-13", + "AffectedVersionRange": "*", + "Summary": "Cross-site Scripting (XSS)", + "Contributor": { + "Discloser": "", + "Fixer": "" + }, + "Package": { + "Registry": "other", + "Name": "online-invoicing-system", + "URL": "https://github.com/bigprof-software/online-invoicing-system", + "Downloads": "" + }, + "CWEs": [ + { + "ID": "79", + "Description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + } + ], + "CVSS": + { + "Version": "3.1", + "AV": "N", + "AC": "L", + "PR": "N", + "UI": "R", + "S": "U", + "C": "L", + "I": "L", + "A": "N", + "E": "P", + "RL": "U", + "RC": "C", + "Score": "5.1" + }, + "CVEs": [ + "" + ], + "Repository": { + "URL": "https://github.com/bigprof-software/online-invoicing-system", + "Codebase": [ + "PHP" + ], + "Owner": "bigprof-software", + "Name": "online-invoicing-system", + "Forks": "17", + "Stars": "20" + }, + "Permalinks": [ + "" + ], + "References": [], + "PrNumber": "", + "FixSubmissionCount": "" +}