CyberRota Analysis
AI-GeneratedFOSSBilling versions 0.6.0 through 0.7.2 are vulnerable to a stored cross-site scripting (XSS) flaw that allows an attacker with admin access to inject malicious JavaScript into email content, which executes in the browsers of clients viewing their email history. This vulnerability poses a significant risk to client security and privacy, making it critical for organizations using affected versions to upgrade to version 0.8.0 or implement workarounds, such as restricting admin access and monitoring email content for suspicious activity. Administrators and security teams should prioritize this issue to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in the client-facing email history views of FOSSBilling. Email HTML content (`content_html`) is rendered into a JavaScript template literal using the `|raw` filter, bypassing all output escaping. An attacker with admin access can inject malicious JavaScript payloads into email content that execute in the browser of any client who views their email history. Version 0.8.0 contains a fix. Some workarounds are available. Restrict admin account access, audit email content in the database for suspicious payloads, and/or monitor client accounts for unusual activity.