InvoicePlane vulnerabilities

InvoicePlane 1.7.2-beta-1 stores client_email without enforcing email syntax and renders it unescaped inside double-quoted value attributes in the invoice and quote mailer forms. An administrator who can edit a client can store attribute-breaking input, and when the mailer is configured, JavaScript executes when another authenticated administrator opens the related mailer page. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane's User_Controller compares the session user_type value with the required role using PHP's loose inequality operator. Under a non-standard session backend that returns unexpected scalar types, type juggling can cause a value that is not strictly the required role to pass the authorization check. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane's Users::change_password() method accepts a user_id from the URL and updates that account's password without an object-level authorization check. An authenticated secondary administrator can target the primary administrator account and replace its password without knowing the current password. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane omits ensure_valid_post_request() from delete methods including Payments::delete(), Recurring::delete(), and User_clients::delete(). Although the routes require POST, they do not validate the request's CSRF token. An attacker can submit a cross-origin form through an authenticated administrator's browser to delete financial records and other application data. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane exposes Recurring::stop() as a state-changing GET route without CSRF token validation. When an authenticated administrator loads attacker-controlled content that requests /invoices/recurring/stop/{id}, the application stops the selected recurring invoice. An attacker can target multiple identifiers to interrupt recurring billing and cause financial loss. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane stores an administrator-controlled custom_field_table value without validating it against the allowed custom-field table names. Mdl_custom_fields::used() later concatenates that stored value into the FROM table and WHERE column identifier positions, so opening the custom-field edit form executes a second-order SQL injection. The injection can query arbitrary schema data and can cause application errors or denial of service. Fixed in version 1.7.2.

InvoicePlane before version 1.7.2: Invoices::generate_xml() appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier. A low-privileged attacker who can influence the e-invoice configuration can use traversal sequences to include an existing PHP file. Code execution requires a separate file-upload or file-write primitive.

InvoicePlane before version 1.7.2 exposes Invoices::delete() and Invoices::delete_invoice_tax() as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator loads attacker-controlled content that requests an affected route, the application can delete an invoice or invoice tax record. The cross-origin action can remove financial data without the administrator's intent.

InvoicePlane version 1.4.10 is vulnerable to an Arbitrary File Upload, allowing an authenticated user to upload a malicious file to the webserver. An attacker can upload a script that can compromise the webserver.

In InvoicePlane before version 1.7.2-rc-1, the permitted template list is built by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted and can be selected as a public template, then executed when rendering a public invoice.

InvoicePlane through 1.6.3 contains a file upload vulnerability allowing authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs no object-level authorization check on user_id = 1. A Secondary Administrator (user_type = 1, user_id != 1) can rewrite the Primary Administrator's user_type to 2 (Guest / read-only), destroying the root account's privilege and locking the legitimate owner out of the instance. At time of publication, there are no publicly available patches.

InvoicePlane, a self-hosted open source application for managing invoices, clients, and payments, in version 1.7.2 has a vulnerability allowing takeover of the primary administrator account. A previous fix (PR #1638) protected the direct password change but not the user_email attribute. A secondary administrator can edit the primary administrator's account and change their email address, then use the public password recovery flow to receive a reset token and take over user_id=1.

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because Admin_Controller trusts the user_type snapshot stored in an existing session instead of revalidating ip_users.user_type. When one administrator downgrades another account, the target's active session continues to authorize administrative requests. The downgraded user can use Users::form() to set user_type back to 1, restoring the database role and making the privilege escalation persistent. This vulnerability is fixed in 1.7.2.

Prior to 1.7.2, InvoicePlane's Cron::recur() method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can place forged log lines into the audit trail, potentially corrupting forensic records and interfering with log-based monitoring. Fixed in version 1.7.2.

InvoicePlane before version 1.7.2 stores and serves uploaded images without stripping EXIF metadata. When an administrator shares an image with another user, the recipient can retrieve GPS coordinates, timestamps, and device information. The vulnerability is fixed in version 1.7.2.

In InvoicePlane prior to 1.7.2, the administrator-controlled tax_rate_decimal_places setting is interpolated into an ALTER TABLE statement for ip_tax_rates in Settings::index() without strict integer validation. A crafted setting value can add clauses to the schema-changing statement and remove or alter required database columns. The vulnerability is fixed in 1.7.2.

In InvoicePlane 1.5.11, a misconfigured web server allows an unauthenticated attacker to list directories and download files that should be private via directory traversal.

InvoicePlane 1.5.11 lacks rate-limiting for password reset and uses a weak, predictable token generation mechanism.

InvoicePlane 1.5.11 discloses the full path of the file upload directory when using the upload feature.