FOSSBilling stored XSS in support ticket notes lets staff run code as administrators
Hidden code planted by staff can take over administrator rights.
Summary
FOSSBilling's support ticket notes store input without sanitization. A staff account with only the support.manage_tickets permission can plant a script that runs when another staff member, including a Super Administrator, opens the notes, and perform actions with the viewer's privileges.
Affected when
- Staff account with the support.manage_tickets permission
What to do
Update to FOSSBilling 0.8.9 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen