NCH Express CVE-2020-11560 Clear Text Password Storage

CVE: CVE-2020-11560

Title: Clear text password storage in NCH express invoice software


About NCH express invoice software:


Express Invoice lets you create invoices you can print, email or fax directly to clients for faster payment. The reporting functionality allows you to keep track of payments, overdue accounts, sales team performance and more.


Vulnerability: Express Invoice has functionality that allows to access it over the web.

While configuring web access function application ask for user details such as username, password, email, etc
Application stores this information in "C:\ProgramData\NCH Software\ExpressInvoice\Accounts" folder in clear-text.

Impact: An authenticated malicious user with access to the configuration file may obtain the exposed password to gain access to any user account




POC








Comments

  1. This is an awesome post.Really very informative and creative contents. These concept is a good way to enhance the knowledge.I like it and help me to development very well.Thank you for this brief explanation and very nice information.Well, got a good knowledge.
    CRM with Invoicing

    ReplyDelete

Post a Comment

Popular posts from this blog

CVE-2020-13474: NCH Express Accounts- Privilege Escalation

CVE-2020-23446 Verint Workforce Optimization (WFO)

CVE-2020-13480-Verint-HTML Injection