CVE-2017-14239: Dolibarr ERP/CRM 6.0.0 Cross-Site Scripting (XSS) Vulnerability
Summary
CVE-2017-14239: Dolibarr cross-site scripting (XSS) vulnerability. Affects dolibarr/dolibarr versions >= 6.0.0, < 6.0.1. Fixed in 6.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr ERP/CRM is an open-source software package that provides enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is widely used for managing company information, including addresses, contact details, and other related data. However, Dolibarr ERP/CRM version 6.0.0 is vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or HTML through various parameters in the 'company.php' file. These parameters include CompanyName, CompanyAddress, CompanyZip, CompanyTown, Fax, EMail, Web, ManagingDirectors, Note, Capital, ProfId1, ProfId2, ProfId3, ProfId4, ProfId5, and ProfId6. An attacker can exploit this vulnerability to execute malicious scripts or steal sensitive information from authenticated users.
How To Fix
Minimum fixed version
6.0.1
This is the first release that contains the fix.
composer require dolibarr/dolibarr:6.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can sanitize the input data for the affected parameters to prevent the execution of malicious scripts. This can be done by implementing input validation and output encoding techniques. Here's an example of how to sanitize the CompanyName parameter in PHP:
$companyName = htmlspecialchars($_POST['CompanyName'], ENT_QUOTES, 'UTF-8');
Conclusion
The Dolibarr ERP/CRM version 6.0.0 is vulnerable to a cross-site scripting (XSS) attack, which allows authenticated users to inject arbitrary web script or HTML through certain parameters. This can lead to the execution of malicious scripts or theft of sensitive information. To mitigate this vulnerability, users should upgrade to Dolibarr ERP/CRM version 6.0.1 or later. In the meantime, implementing input validation and output encoding techniques can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr ERP/CRM is an open-source software package that provides enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is used by businesses to manage company information, contacts, and various other aspects of their operations.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code, theft of sensitive information, or hijacking of user sessions.
The XSS vulnerability in Dolibarr ERP/CRM version 6.0.0 allows authenticated users to inject arbitrary web script or HTML through certain parameters. This can be exploited by attackers to execute malicious scripts or steal sensitive information from other users of the system.
Yes, the vulnerability can be fixed by upgrading to Dolibarr ERP/CRM version 6.0.1 or later. The upgrade includes security patches that address the XSS vulnerability. Users should download the latest version from the official Dolibarr website and follow the upgrade instructions provided in the documentation.
As a temporary workaround, users can sanitize the input data for the affected parameters to prevent the execution of malicious scripts. This can be done by implementing input validation and output encoding techniques. However, it is strongly recommended to apply the official fix by upgrading to the latest version of Dolibarr ERP/CRM.
References
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
