CVE-2018-10095: Dolibarr Cross-site scripting (XSS) vulnerability
Summary
CVE-2018-10095: Dolibarr Cross-site scripting (XSS) vulnerability. Affects dolibarr/dolibarr versions < 7.0.2. Fixed in 7.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Dolibarr is an open-source ERP and CRM system designed for small and medium-sized businesses. It provides various features such as accounting, inventory management, project management, and customer relationship management. Dolibarr is written in PHP and is available as a composer package. However, versions prior to 7.0.2 are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in Dolibarr allows remote attackers to inject arbitrary web script or HTML through the 'foruserlogin' parameter in the 'adherents/cartes/carte.php' file. This can lead to the execution of malicious code in the context of the user's browser, potentially compromising sensitive information or performing unauthorized actions. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
7.0.2
This is the first release that contains the fix.
composer require dolibarr/dolibarr:7.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by sanitizing user input in the affected 'foruserlogin' parameter. This can be done by applying appropriate input validation and output encoding techniques to prevent the execution of malicious scripts. Here is an example of how to sanitize the input in PHP:
$foruserlogin = htmlspecialchars($_GET['foruserlogin'], ENT_QUOTES, 'UTF-8');
Conclusion
The Dolibarr ERP and CRM system prior to version 7.0.2 is vulnerable to a cross-site scripting (XSS) attack. This vulnerability allows remote attackers to inject arbitrary web script or HTML, potentially compromising sensitive information or performing unauthorized actions. To mitigate this risk, it is recommended to upgrade Dolibarr to the latest version and regularly update the software to ensure the latest security fixes are applied. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM system designed for small and medium-sized businesses. It provides various features such as accounting, inventory management, project management, and customer relationship management.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code in the context of the user's browser, potentially compromising sensitive information or performing unauthorized actions.
The vulnerability in Dolibarr allows remote attackers to inject arbitrary web script or HTML, which can lead to the execution of malicious code in the user's browser. This can result in the compromise of sensitive information, such as login credentials or personal data, and may allow unauthorized actions to be performed on behalf of the user.
To fix this vulnerability, it is recommended to upgrade Dolibarr to version 7.0.2 or later. This version includes a patch that addresses the XSS vulnerability. Users should follow the upgrade instructions provided by the project. Regularly updating the software is also important to ensure the latest security fixes are applied.
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by sanitizing user input in the affected 'foruserlogin' parameter. This can be done by applying appropriate input validation and output encoding techniques to prevent the execution of malicious scripts.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
