Cross Site Scripting Vulnerability Affecting ALL Editions of nBill

[netshine]

A cross site scripting (xss) vulnerability has been discovered, affecting ALL versions of nBill. Whilst this is not a critical problem and is unlikely to result in the compromise of your site or any client data, it is nevertheless recommended that you apply the relevant patch from the replies below (I will reply to this topic once for each edition of nBill).

The main component download files have all been patched, so if you download the component after 10:40am BST on 13th July 2011, you do not need to apply the patch.

To apply the patch, simply replace your /components/com_nbill/nbill.php file with the relevant attachment below (in the case of nBill 1, the file to replace is /components/com_netinvoice/netinvoice.php).

[netshine]

For nBill 2.1.1 (Standard Edition), please use the attached file (it is the same file regardless of which version of Joomla or Mambo you are using).

[netshine]

For nBill 1.2_10 (Standard Edition), please use this file.

[netshine]

For nBill Lite (2.0.10), please use this one.