CVE-2025-55579 - SolidInvoice Stored Cross-Site Scripting (XSS) in Tax Rates

Summary

SolidInvoice is vulnerable to a Stored Cross-Site Scripting (XSS) issue in the Tax Rates Feature. An authenticated attacker can inject arbitrary JavaScript into the application, which will then execute in users' browsers.

Affected Versions

• Vulnerable: 2.3.7
• Fixed: 2.3.8

Impact

Exploitation allows a malicious user to store arbitrary JavaScript in the application, which will execute in the context of other authenticated users who view the Tax Rates page. If the application is deployed in a multi-user environment - for example, with multiple admins, this could lead to:

• Session hijacking
• Credential or token theft
• Phishing or social engineering attacks
• Arbitrary actions performed on behalf of another user

Proof-of-Concept

1. Navigate to System > Tax Rates > Add Tax Rate.
2. Enter a payload in the Name field with the following format:
   root@kitploit:~

   <image/src/onerror=prompt(1)>