Description
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manager can save a crafted custom payment-term value. When an authorized user opens Invoice Settings for the same company, Akaunting inserts the stored value into a client-side event-handler expression, causing attacker-controlled JavaScript to execute in the victim's authenticated origin.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Akaunting | Akaunting | 3.3.0 | — |
References
- https://fluidattacks.com/advisories/rhiannon third-party-advisory
- https://github.com/akaunting/akaunting product
- https://github.com/akaunting/akaunting/blob/3.3.0/app/View/Components/Form/Group/PaymentTerm.php technical-description
- https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/form/group/payment_term.blade.php technical-description
- https://github.com/akaunting/akaunting/blob/3.3.0/app/Abstracts/Http/SettingController.php technical-description