InvoiceShelf vulnerabilities

InvoiceShelf prior to version 2.4.1 in multi-company installations allows an Owner of one company to read and overwrite any user account in any other company. The vulnerability stems from missing verification that the target user belongs to the requester's company, enabling account takeover.

InvoiceShelf prior to version 2.2.0 has an SSRF vulnerability in the PDF generation module. User-supplied HTML in the Notes field is passed unsanitized to the Dompdf library, which fetches remote resources, exploitable via PDF preview and email delivery endpoints.

InvoiceShelf before version 2.2.0 has an SSRF vulnerability in the PDF receipt generation module. User-supplied HTML in the Notes field is passed unsanitized to Dompdf, which fetches remote resources, enabling SSRF attacks.

InvoiceShelf before version 2.2.0 has an SSRF vulnerability in the PDF estimate generation module. User-supplied HTML in the Notes field is passed unsanitized to Dompdf, which fetches remote resources, enabling SSRF attacks.