CVE-2021-21260
📋 TL;DR
This stored cross-site scripting (XSS) vulnerability in Online Invoicing System version 4.0 allows attackers to inject malicious scripts into item descriptions. When an admin views these items, the script can extract CSRF tokens and change the admin's password, leading to account takeover. All users running OIS version 4.0 are affected.
💻 Affected Systems
- Online Invoicing System (OIS)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the admin account, allowing attacker to access all system data, modify invoices, steal sensitive business information, and potentially pivot to other systems.
Likely Case
Admin account takeover leading to unauthorized access to financial data, invoice manipulation, and potential data exfiltration.
If Mitigated
Limited impact with proper input validation and output encoding, potentially only minor data leakage if other controls exist.
🎯 Exploit Status
Exploitation requires ability to create or modify items (typically authenticated user), but admin viewing is required for full impact.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.2
Vendor Advisory: https://github.com/bigprof-software/online-invoicing-system/security/advisories/GHSA-rm79-5596-r7q4
Restart Required: No
Instructions:
1. Backup your current OIS installation and database. 2. Download version 4.2 from the official GitHub releases. 3. Replace all files with the new version. 4. Verify the app/items_view.php file contains proper output encoding.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize item description inputs before storage
Implement HTML entity encoding for all user inputs in item description fields
Content Security Policy
allImplement CSP headers to restrict script execution
Add 'Content-Security-Policy: script-src 'self'' to HTTP headers
🧯 If You Can't Patch
- Restrict item creation/modification permissions to trusted users only
- Implement web application firewall rules to block XSS payloads in item descriptions
🔍 How to Verify
Check if Vulnerable:
Check if running OIS version 4.0 by examining version files or checking the admin interface version displayCheck Version:
Check the version.txt file or view the footer in the admin interfaceVerify Fix Applied:
Test item description field with XSS payloads like <script>alert('test')</script> and verify they are properly encoded when displayed📡 Detection & Monitoring
Log Indicators:
- Unusual item creation/modification patterns
- Admin password change requests from unexpected sources
- Script tags in item description fields
Network Indicators:
- HTTP requests containing script payloads in POST data to item endpoints
- Unexpected password reset requests
SIEM Query:
source="web_logs" AND (uri_path="/app/items_view.php" OR uri_path LIKE "%/items/%") AND (http_method="POST" OR http_method="PUT") AND (request_body LIKE "%<script>%" OR request_body LIKE "%javascript:%")🔗 References
- https://github.com/bigprof-software/online-invoicing-system/releases/tag/4.2
- https://github.com/bigprof-software/online-invoicing-system/security/advisories/GHSA-rm79-5596-r7q4
- https://github.com/bigprof-software/online-invoicing-system/releases/tag/4.2
- https://github.com/bigprof-software/online-invoicing-system/security/advisories/GHSA-rm79-5596-r7q4
