CVE-2020-35674

Published: Sep 29, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordReset.php (the endpoint that is responsible for issuing self-service password resets). An unauthenticated attacker is able to send a request containing a crafted payload that can result in sensitive information being extracted from the database, eventually leading into an application takeover. This vulnerability was introduced as a result of the developer trying to roll their own sanitization implementation in order to allow the application to be used in legacy environments.

Affected (1)

Products: Bigprof: Online Invoicing System

1 product

Online Invoicing System

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Bigprof Online Invoicing System	Before 2.9

Related CWEs

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (2)

https://labs.ingredous.com/2020/07/13/ois-sqli/

Source: cve@mitre.org

Broken Link

https://labs.ingredous.com/2020/07/13/ois-sqli/

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

Timeline

No history available yet.