Executive Summary

CVE-2025-55580 is a Stored Cross-Site Scripting (XSS) vulnerability in the Client Module of SolidInvoice version 2.3.7. An authenticated attacker can inject malicious JavaScript code into the 'Name' field when adding a client. This code is stored and later executed in the browsers of other authenticated users who view the Clients page, potentially compromising their sessions and data. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to session hijacking, theft of credentials or tokens, phishing or social engineering attacks, and unauthorized actions performed on behalf of other users in multi-user environments. Essentially, attackers can exploit this to compromise user accounts and perform malicious activities within the application. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the Client Module of SolidInvoice, specifically by attempting to inject a script payload into the 'Name' field when adding a client. For example, an authenticated user can navigate to Clients > Add Client and input a script such as `<script>prompt(document.cookie)</script>` in the Name field. If the script executes when viewing Clients > List Clients, the system is vulnerable. There are no specific network commands provided, but manual testing through the application interface is recommended. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update SolidInvoice to version 2.3.8 or later, where the issue has been resolved. Until the update is applied, restrict access to the Clients module to trusted users only and avoid adding new clients with untrusted input to prevent exploitation. [1]

Useful 0 Not Useful 0