CVE-2020-35675

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable endpoint (admin/pageTransferOwnership.php) lacks CSRF protection, resulting in an attacker being able to escalate their privileges to Administrator and effectively taking over the application.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/bigprof-software/online-invoicing-system/releases/tag/3.0Third Party Advisory
https://labs.ingredous.com/2020/07/13/ois-transfer-csrf/Broken Link
https://github.com/bigprof-software/online-invoicing-system/releases/tag/3.0Third Party Advisory
https://labs.ingredous.com/2020/07/13/ois-transfer-csrf/Broken Link

Timeline

Published: Sep 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-356766.1BigProf Online Invoicing System before 3.1 fails to correctly sanitize an XSS payload when a user registers using the self-registration func CVE-2020-356774.8BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEdi CVE-2020-356786.1Autobahn|Python before 20.12.3 allows redirect header injection.CVE-2020-356797.5smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak v CVE-2020-35685.8A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unau CVE-2020-356807.5smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service (NULL pointe CVE-2020-356817.4Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels CVE-2020-356828.8Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login).CVE-2020-356837.5An issue was discovered in HCC Nichestack 3.0. The code that parses ICMP packets relies on an unchecked value of the IP payload size (extrac CVE-2020-356847.5An issue was discovered in HCC Nichestack 3.0. The code that parses TCP packets relies on an unchecked value of the IP payload size (extract CVE-2020-356859.1An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN f CVE-2020-356867.8The SECOMN service in Sound Research DCHU model software component modules (APO) through 2.0.9.17, delivered on HP Windows 10 computers, may