Reflected XSS on multiple locations and parameters in unilogies/bumsys
Reported on
Nov 2nd 2022
Description
The user input is not being sanitized properly on multiple locations and on different parameters leading to XSS.
Proof of Concept
https://demo.bumsys.org/reports/sales-report/?salesDate="><body%20onpageshow=alert(1)>
Payload
"><body%20onpageshow=alert(1)>
Impact
- Perform any action within the application that the user can perform.
- View any information that the user is able to view.
- Modify any information that the user is able to modify.
- Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.
Occurrences
ajax.php L3315
id parameter is vulnerable.
ajax_pos.php L30
POST parameter salesId is vulnerable.
ajax.php L3100
val parameter is vulnerable.
ajax.php L448
id parameter is vulnerable.
ajax_data.php L174
pqnt parameter is vulnerable.
ajax.php L320
POST parameter productCode is vulnerable.
sales-report.php L12
salesDate is vulnerable.
ajax.php L1746
val parameter is vulnerable. Line 1747 is also vulnerable.
ajax.php L874
POST parameter productCode is vulnerable.
ajax.php L2500
id parameter is vulnerable.
ajax.php L779
POST paymentChequeNo parameter is vulnerable.
ajax.php L1943
id parameter is vulnerable.
ajax.php L540
POST parameter advanceCollectionId is vulnerable.
ajax.php L576
POST parameter paymentChequeNo is vulnerable
ajax.php L9
val parameter is vulerable.
ajax.php L2041
val parameter is vulnerable.
expense-report-single.php L20
dateRange parameter is vulnerable.
ajax.php L1075
id parameter is vulnerable.
expense-report-non-cat.php L22
paymentType and dateRange parameters are vulnerable.
expense-report-non-cat.php L14
paymentType and dateRange parameters are vulnerable.
ajax.php L1817
val parameter is vulnerable.
expense-report-non-cat.php L64
paymentType and dateRange parameters are vulnerable.
ajax.php L1281
POST parameter shopAdvanceCollectionId is vulnerable.
ajax.php L1606
POST salaryTypes parameter is vulnerable.
ajax.php L2728
POST dueBillPaymentChequeNo parameter is vulnerable.
ajax.php L512
POST paymentChequeNo parameter is vulnerable.
ajax.php L1166
POST parameter receivedPaymentId is vulnerable.
ajax.php L1930
POST salaryType parameter is vulnerable.
ajax_call.php L31
id parameter is vulnerable.
ajax.php L1305
POST parameter userLanguage is vulnerable.
expense-report-single.php L68
cid and dateRange parameters are vulnerable.
SECURITY.md exists
a year ago
Opps. Thanks again @krizzsk. I will fix the issue as soon as possible. Your work is really great.
Khurshid Alam
Dear Brother, Sorry for the delay.
All of the issue you have mentioned has been solved. Please check and let me if it is okay. Thank you
Khurshid Alam
Hello @krizzsk, I hope you are doing well.
I need some help about SQL Injection Attack. Could you please help us by finding if there any issue regarding SQL Injection?
Looking forward to hear you soon. Thank you