Join GitHub today
GitHub is home to over 31 million developers working together to host and review code, manage projects, and build software together.Sign up
I have find a Reflected XSS vulnerability in this sdk #13
The vulnerability exists due to insufficient filtration of user-supplied data in “permToken” HTTP GET parameter that will be passed to “invoice-sdk-php-master/samples/permissions.php”. The infected source code is line 9, there is no protection on $_GET['permToken']; if $_GET['permToken'] contains evil js code, line 9 will trigger untrusted code to be excuted on the browser side.
So if a attacker construct a special url as follow and send it to a victim, when the victim click the url, the code which is contained in the url will be executed on the victim's browser side to do some evil.
Discoverer: ADLab of Venustech