CVE-2020-13828: Dolibarr stored Cross-Site Scripting (XSS) vulnerability
Summary
CVE-2020-13828: Dolibarr stored Cross-Site Scripting (XSS) vulnerability. Affects dolibarr/dolibarr versions < 11.0.4. No fix is published. How to fix ↓
Also tracked for
- dolibarr · Bitnami
The same CVE-2020-13828 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM software designed for small and medium-sized businesses. It provides various features such as invoicing, inventory management, project management, and more. Dolibarr is written in PHP and is available on Packagist. However, Dolibarr version 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities.
Vulnerability Detail
The stored XSS vulnerabilities in Dolibarr allow remote authenticated attackers to inject arbitrary web script or HTML. These vulnerabilities can be exploited through different endpoints of the application. The affected endpoints and parameters include:
- ticket/card.php?action=create with the subject, message, or address parameter
- adherents/card.php with the societe or address parameter
- product/card.php with the label or customcode parameter
- societe/card.php with the alias or barcode parameter
These vulnerabilities could potentially lead to the execution of malicious code in the context of the affected user's browser, compromising the confidentiality and integrity of the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can sanitize user input to prevent the execution of malicious scripts. This can be done by implementing proper input validation and output encoding techniques. Here is an example of how to sanitize user input in PHP:
$subject = htmlspecialchars($_POST['subject']);
$message = htmlspecialchars($_POST['message']);
$address = htmlspecialchars($_POST['address']);
By using the htmlspecialchars function, special characters will be converted to their HTML entities, preventing them from being interpreted as code.
Conclusion
Dolibarr version 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities. These vulnerabilities can be exploited by authenticated attackers to inject arbitrary web script or HTML, potentially compromising the confidentiality and integrity of the application. It is recommended to upgrade to a version beyond 11.0.4 to mitigate the risk of exploitation. Implementing input validation and output encoding techniques can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM software designed for small and medium-sized businesses. It provides various features such as invoicing, inventory management, project management, and more.
A stored XSS vulnerability allows an attacker to inject malicious code into a website or web application. This code is then stored on the server and served to other users, potentially compromising their browsers and allowing the attacker to perform unauthorized actions.
The Dolibarr stored XSS vulnerabilities can be exploited by authenticated attackers who have access to the affected endpoints. By injecting malicious scripts or HTML code into the vulnerable parameters, the attacker can execute arbitrary code in the context of other users' browsers.
The potential consequences of these vulnerabilities include unauthorized access to sensitive information, manipulation of user data, and the possibility of further attacks such as phishing or session hijacking.
To protect your Dolibarr installation from these vulnerabilities, it is crucial to keep the software up to date. Regularly check for updates and apply them as soon as they are available. Additionally, implement proper input validation and output encoding techniques to sanitize user input and prevent the execution of malicious scripts.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
