| 标题 | Open-Source SolidInvoice 2.4.0 Stored Cross-Site Scripting (XSS) |
|---|
| 描述 | SolidInvoice 2.4.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the Recurring Invoice module (/invoice/recurring). The client name parameter is not properly sanitized when creating a new client, allowing an authenticated attacker to inject malicious JavaScript code. The payload is persistently stored in the application and executed whenever the recurring invoice list is accessed, impacting all authenticated users. Exploitation requires authentication.
The complete proof of concept (PoC) and exploitation steps are documented in the file: ???? PoC - Stored XSS 1.md. |
|---|
| 来源 | ⚠️ https://github.com/Gabrielmouraofc/PoC_Vuldb |
|---|
| 用户 | GabrielMoura (UID 88644) |
|---|
| 提交 | 2025-08-08 02時52分 (10 月前) |
|---|
| 管理 | 2025-08-19 15時37分 (12 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 320544 [SolidInvoice 直到 2.4.0 Recurring Invoice /invoice/recurring client name 跨网站脚本] |
|---|
| 积分 | 20 |
|---|