CVE-2026-6624: BichitroGan ISP Billing XSS Vulnerability

CVE-2026-6624 Overview

A Cross-Site Scripting (XSS) vulnerability has been identified in BichitroGan ISP Billing Software version 2025.3.20. The vulnerability affects an unknown function within the file /?_route=pool/add of the Pool List Interface component. An attacker can exploit this vulnerability by manipulating input parameters to inject malicious scripts, leading to cross-site scripting attacks. The attack can be performed remotely over the network and requires high privileges along with user interaction.

Critical Impact

This XSS vulnerability enables remote attackers with administrative privileges to inject malicious scripts that execute in victim browsers, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of authenticated users.

Affected Products

• BichitroGan ISP Billing Software 2025.3.20
• Pool List Interface Component (/?_route=pool/add)

Discovery Timeline

• 2026-04-20 - CVE CVE-2026-6624 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-6624

Vulnerability Analysis

This vulnerability falls under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The flaw exists in the Pool List Interface of BichitroGan ISP Billing Software, specifically within the route handler at /?_route=pool/add.

The vulnerability allows an attacker with high-level privileges to inject malicious content through manipulated input that is not properly sanitized before being rendered in the web interface. When a victim user with an active session interacts with the compromised page, the injected script executes within their browser context.

The exploit has been made publicly available, increasing the risk of active exploitation. The vendor was contacted regarding this disclosure but did not respond.

Root Cause

The root cause of this vulnerability is improper input validation and output encoding in the Pool List Interface. The application fails to adequately sanitize user-supplied input before incorporating it into dynamically generated web pages. This allows specially crafted input containing script tags or JavaScript event handlers to be stored or reflected back to users, where it executes as legitimate code within the application's trusted domain context.

Attack Vector

The attack vector is network-based, requiring an authenticated attacker with elevated privileges to inject the malicious payload. The exploitation scenario involves:

1. An attacker with administrative access navigates to the Pool List Interface at /?_route=pool/add
2. The attacker submits a crafted payload containing malicious JavaScript through an improperly validated input field
3. The malicious content is either stored in the database or reflected in the response
4. When another user (victim) accesses the affected page, the malicious script executes in their browser
5. The script can then steal session cookies, capture credentials, or perform actions as the victim user

For detailed technical information about this vulnerability, refer to the GitHub Issue Discussion and the VulDB Vulnerability Summary.

Detection Methods for CVE-2026-6624

Indicators of Compromise

• Unusual HTTP requests to /?_route=pool/add containing encoded script tags or JavaScript event handlers
• Web server logs showing requests with <script>, javascript:, onerror=, onload=, or similar XSS payload patterns in query parameters or POST data
• Browser console errors indicating blocked inline scripts (if CSP is enabled) or unexpected script execution
• Reports from users of unexpected behavior or redirects when accessing the Pool List Interface

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS payload patterns targeting the /pool/add route
• Enable detailed access logging on the web server and configure alerts for requests containing potentially malicious script content
• Deploy endpoint detection solutions that can identify browser-based attacks and script injection attempts
• Configure intrusion detection systems (IDS) to monitor for XSS attack signatures in HTTP traffic

Monitoring Recommendations

• Monitor access logs for the /?_route=pool/add endpoint, particularly requests from administrative users
• Set up alerts for unusual patterns of access to the Pool List Interface or unexpected parameter values
• Review application audit logs for changes made through the affected interface that may indicate exploitation
• Correlate web server logs with authentication events to identify potential privilege abuse scenarios

How to Mitigate CVE-2026-6624

Immediate Actions Required

• Restrict access to the Pool List Interface (/?_route=pool/add) to only essential administrative users
• Implement Content Security Policy (CSP) headers to prevent inline script execution
• Deploy a Web Application Firewall (WAF) with XSS protection rules in front of the application
• Audit administrative accounts and revoke access for unused or unnecessary privileged accounts

Patch Information

No vendor patch is currently available. According to the vulnerability disclosure, the vendor was contacted about this issue but did not respond. Organizations using BichitroGan ISP Billing Software 2025.3.20 should implement the workarounds listed below and monitor for future security updates.

For additional details, see the VulDB Submission Report.

Workarounds

• Implement strict input validation on all user-controllable parameters in the Pool List Interface
• Apply output encoding (HTML entity encoding) for all user-supplied data rendered in the web interface
• Configure Content Security Policy headers with script-src 'self' to block inline scripts
• Consider isolating administrative interfaces on a separate network segment accessible only from trusted management workstations
• Enable HTTPOnly and Secure flags on all session cookies to reduce the impact of potential session theft

# Example: Add Content Security Policy header in Apache
# Add to .htaccess or Apache configuration
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none'; frame-ancestors 'self'"

# Example: Add Content Security Policy header in Nginx
# Add to nginx.conf or site configuration
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none'; frame-ancestors 'self'" always;