CVE-2018-19995: Dolibarr stored cross-site scripting (XSS) vulnerability
Summary
CVE-2018-19995: Dolibarr stored cross-site scripting (XSS) vulnerability. Affects dolibarr/dolibarr versions < 8.0.4. Fixed in 8.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM system designed for small and medium-sized businesses. It provides a range of features including accounting, inventory management, project management, and customer relationship management. Dolibarr is widely used by organizations to streamline their business processes and improve efficiency. However, a stored cross-site scripting (XSS) vulnerability has been discovered in Dolibarr version 8.0.2.
Vulnerability Detail
The vulnerability allows remote authenticated users to inject arbitrary web script or HTML into the application. Specifically, the "address" and "town" parameters in the user/card.php endpoint are vulnerable to XSS attacks. An attacker with authenticated access to the application can exploit this vulnerability by submitting malicious input in these parameters. When the input is displayed to other users or administrators, the injected script or HTML will be executed in their browsers, potentially leading to session hijacking, data theft, or other malicious actions.
How To Fix
Minimum fixed version
8.0.4
This is the first release that contains the fix.
composer require dolibarr/dolibarr:8.0.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can apply a temporary workaround to mitigate the risk. The workaround involves implementing input validation and output encoding to prevent the execution of malicious scripts. Developers can use security libraries or frameworks that provide built-in protection against XSS attacks. Additionally, administrators can configure web application firewalls (WAFs) to filter out malicious input and prevent the exploitation of the vulnerability.
Conclusion
The stored cross-site scripting (XSS) vulnerability in Dolibarr version 8.0.2 poses a moderate risk to organizations using the software. To mitigate this vulnerability, it is crucial to upgrade to the latest version (8.0.4 or later) or apply the recommended workarounds. Regularly monitoring for security updates and following secure coding practices will help maintain the integrity and security of the Dolibarr installation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM system used by small and medium-sized businesses for managing various aspects of their operations, including accounting, inventory, and customer relationships.
A stored XSS vulnerability allows an attacker to inject malicious scripts or HTML into a web application, which is then stored and executed when accessed by other users. This can lead to various attacks, such as session hijacking or data theft.
An authenticated user can exploit the vulnerability by submitting specially crafted input in the "address" or "town" parameters of the user/card.php endpoint. When this input is displayed to other users or administrators, the injected script or HTML will be executed in their browsers.
The XSS vulnerability in Dolibarr can allow an attacker to hijack user sessions, steal sensitive data, or perform other malicious actions on behalf of the targeted user. This can lead to unauthorized access, data breaches, and compromise of the application's integrity.
To protect your Dolibarr installation, it is recommended to upgrade to version 8.0.4 or later, which includes a fix for the XSS vulnerability. Additionally, you should follow secure coding practices, implement input validation and output encoding, and consider using web application firewalls (WAFs) to filter out malicious input.
References
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
