| Package | Affected versions | Patched versions |
|---|---|---|
| online invoicing system | < 2.9 | 2.9 |
BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordReset.php (the endpoint that is responsible for issuing self-service password resets). An unauthenticated attacker is able to send a request containing a crafted payload that can result in sensitive information being extracted from the database, eventually leading into an application takeover. This vulnerability was introduced as a result of the developer trying to roll their own sanitization implementation in order to allow the application to be used in legacy environments.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free