ModernBill 4.3.0 XSS and RFI Vulnerability Advisory

Critical Vulnerability Information Vulnerability Description Software Name: ModernBill Affected Versions: 4.3.0 and earlier Release Date: April 10, 2005 Vendor: ModernGigabyte, LLC Software Purpose: A billing and management system widely used by web hosting providers to manage billing and financial data Vulnerability Details 1. Cross-Site Scripting (XSS) Vulnerability - Details: Multiple cross-site scripting vulnerabilities exist in the order form of ModernBill. - Impact: Attackers can exploit this vulnerability to execute client-side code within the victim's web browser context, steal sensitive user data, or display malicious code in the victim's browser. - Example: 2. Remote File Inclusion (RFI) Vulnerability - Details: ModernBill includes a directory named "samples" containing files to help users customize ModernBill. One of these scripts, "news.php", contains a dangerous remote file inclusion vulnerability. - Impact: If global variables are enabled and there are no inclusion restrictions, attackers can remotely include arbitrary PHP code. - Example: Solution Recommendation: A fixed version has been released. Users are advised to immediately upgrade their ModernBill installation. Related Information Original Announcement: http://www.gulftech.org/?node=research&article_id=00067-04102005

Goal Reached Thanks to every supporter — we hit 100%!

ModernBill 4.3.0 XSS and RFI Vulnerability Advisory