CVE-2018-16808: Dolibarr Stored Cross-site Scripting in expensereport/card.php
Summary
CVE-2018-16808: Dolibarr Stored Cross-site Scripting in expensereport/card.php. Affects dolibarr/dolibarr versions < 7.0.1. Fixed in 7.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM software package that provides various functionalities for businesses. It is widely used for managing expenses, including expense reports. The expense reports plugin in Dolibarr allows users to create and manage expense reports, including adding comments and notes.
Vulnerability Detail
The vulnerability identified as CVE-2018-16808 affects Dolibarr versions up to 7.0.0. It is a stored cross-site scripting (XSS) vulnerability that exists in the expensereport/card.php file of the expense reports plugin. The vulnerability can be exploited through the 'comments' parameter or a public or private note. An attacker can inject malicious scripts or HTML code into the comments or notes, which will be executed when viewed by other users. This can lead to various consequences, such as unauthorized access, data theft, or the execution of arbitrary code.
How To Fix
Minimum fixed version
7.0.1
This is the first release that contains the fix.
composer require dolibarr/dolibarr:7.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or upgrade to the fixed version to eliminate the risk of exploitation.
Conclusion
The Dolibarr software package is vulnerable to a stored cross-site scripting (XSS) vulnerability in the expense reports plugin. This vulnerability can be exploited to execute malicious code or steal sensitive information. Users are advised to upgrade to the latest version of Dolibarr to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM software package that provides various functionalities for businesses, including expense management.
The expense reports plugin in Dolibarr allows users to create and manage expense reports, including adding comments and notes.
Stored cross-site scripting (XSS) is a type of vulnerability where an attacker can inject malicious scripts or HTML code into a web application, which is then stored and executed when viewed by other users.
The potential consequences of this vulnerability include unauthorized access, data theft, and the execution of arbitrary code.
To fix this vulnerability, it is recommended to upgrade Dolibarr to version 7.0.1 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
