CVE-2019-19212: Dolibarr ERP/CRM - Cross-site Scripting via qty parameter in product/fournisseurs.php
Summary
CVE-2019-19212: Dolibarr Cross-site Scripting via the qty parameter in product/fournisseurs.php. Affects dolibarr/dolibarr versions >= 3.0, <= 10.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr ERP/CRM is an open-source software package that combines enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is designed to help businesses manage their operations, including inventory, sales, invoicing, and more. Dolibarr is widely used across various industries and has a large user base. However, a vulnerability has been discovered in versions 3.0 through 10.0.3 of Dolibarr ERP/CRM that allows for cross-site scripting (XSS) attacks via the 'qty' parameter in the 'product/fournisseurs.php' file, specifically on the product price screen. This vulnerability can potentially lead to unauthorized access, data theft, and other malicious activities.
Vulnerability Detail
The vulnerability in Dolibarr ERP/CRM allows an attacker to inject malicious scripts into the application, which are then executed in the context of the user's browser. By manipulating the 'qty' parameter in the 'product/fournisseurs.php' file, an attacker can craft a specially crafted request that includes malicious code. When a user views the product price screen, the injected code is executed, potentially leading to the theft of sensitive information, session hijacking, or the installation of malware on the user's system. This vulnerability is classified as critical, with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement input validation and sanitization measures to mitigate the risk of XSS attacks. This can involve implementing server-side validation of user input, encoding user-generated content before displaying it, and implementing content security policies (CSP) to restrict the execution of potentially malicious scripts. However, these measures should be seen as temporary solutions, and it is strongly advised to apply the official patches and updates provided by the Dolibarr development team.
Conclusion
The vulnerability in Dolibarr ERP/CRM versions 3.0 through 10.0.3 allows for cross-site scripting (XSS) attacks via the 'qty' parameter in the 'product/fournisseurs.php' file. This critical vulnerability can lead to unauthorized access, data theft, and other malicious activities. Users are strongly advised to update their Dolibarr installations to the latest version available and apply the necessary security patches. Regularly updating and patching all software components used in the application stack is also crucial to minimize the risk of similar vulnerabilities in the future. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr ERP/CRM is an open-source software package that combines enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is designed to help businesses manage their operations, including inventory, sales, invoicing, and more.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, manipulate website content, or perform other malicious actions.
The vulnerability in Dolibarr ERP/CRM allows attackers to inject and execute malicious scripts in the context of a user's browser. This can lead to unauthorized access, data theft, session hijacking, and other malicious activities.
Yes, the Dolibarr development team has released updates addressing this vulnerability. Users are strongly advised to update their Dolibarr ERP/CRM installations to the latest version available to mitigate the risk.
While implementing input validation and sanitization measures can help mitigate the risk of XSS attacks, it is strongly recommended to apply the official patches and updates provided by the Dolibarr development team as a long-term solution.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
