Indian Invoicing System EUVD-2026-31616

The attacker must hold a low-privilege authenticated session on the Indian Invoicing System application (confirmed by CVSS PR:L); unauthenticated exploitation is not possible based on the CVSS vector. The vulnerability is specifically within the database-backed Invoice Template Render flow triggered through /Invoicing/add_order.php, meaning the application must be running this component and the attacker must have permission to create or edit orders. Exploitation further requires a second victim user to passively trigger the stored payload by rendering an invoice containing the malicious customer_name (confirmed by CVSS UI:P) - exploitation is therefore not automatable end-to-end (consistent with SSVC Automatable: no). Limiting factors: low-privilege authentication is a prerequisite barrier; victim interaction is mandatory, preventing silent server-side exploitation; impact is confined to integrity (VI:L) with no confidentiality or availability consequence, making data exfiltration or service disruption infeasible through this vector alone; the software is a niche PHP application typically deployed in small-business or academic environments, naturally limiting the exposed population.

The CVSS 4.0 base score of 2.0 accurately reflects a low-severity finding: the vector AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N confirms network reachability but requires low-privilege authentication (PR:L) and passive victim interaction (UI:P), with impact confined to low integrity on the vulnerable system only - no confidentiality breach, no availability impact, no scope change to subsequent systems. EPSS at 0.03% and the 9th percentile corroborates that mass exploitation is not occurring. The vulnerability is absent from CISA KEV, further reducing urgency. The SSVC assessment (Exploitation: poc, Automatable: no, Technical Impact: partial) aligns with these signals - the existence of a public POC marginally elevates risk above a purely theoretical finding, but the non-automatable designation and partial impact cap real-world priority. The primary realistic threat is insider abuse or a targeted attack where an authenticated low-privilege user plants payloads for a privileged reviewer. For organizations not running this software or running it in an isolated internal network, this presents negligible risk. No conflicting signals between data sources were identified.

An authenticated user with low-privilege access (e.g., a clerk or sales role) navigates to the add-order page and submits a new invoice with a crafted customer_name value containing a <script> payload, which is stored in the database without sanitization. When an administrator or another user later views or prints the invoice - a routine workflow - the stored script executes silently in their browser session, enabling session token theft, credential harvesting, or UI redressing. A working proof-of-concept demonstrating this flow is publicly available on GitHub.