CVE-2024-34051: Reflected Cross-Site Scripting (XSS) in Dolibarr
Summary
CVE-2024-34051: Reflected Cross-Site Scripting (XSS) in Dolibarr. Affects dolibarr/dolibarr versions < 19.0.2. Fixed in 19.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM system designed for small and medium-sized businesses. It provides various features such as accounting, invoicing, inventory management, and more. Dolibarr is widely used for its flexibility and ease of use. However, a vulnerability has been discovered in versions prior to 19.0.2 that allows for Reflected Cross-Site Scripting (XSS) attacks.
Vulnerability Detail
The vulnerability exists in the 'card.php' file located in the 'htdocs/compta/paiement' directory of Dolibarr. It is caused by insufficient input sanitization of the 'facid' parameter. An attacker can exploit this vulnerability by injecting a crafted payload into the 'facid' parameter, which will be reflected back to the user's browser. This can lead to the execution of arbitrary web script or HTML, potentially allowing the attacker to steal sensitive information or perform other malicious actions.
How To Fix
Minimum fixed version
19.0.2
This is the first release that contains the fix.
composer require dolibarr/dolibarr:19.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to manually sanitize the 'facid' parameter before using it in the application. This can be done by using appropriate input validation and sanitization techniques, such as HTML encoding or using a library that provides protection against XSS attacks.
Conclusion
The Reflected Cross-Site Scripting (XSS) vulnerability in Dolibarr prior to version 19.0.2 can be exploited by injecting a crafted payload into the 'facid' parameter. Upgrading to the latest version or applying proper input sanitization is recommended to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM system designed for small and medium-sized businesses. It offers various features for managing accounting, invoicing, inventory, and more.
Reflected Cross-Site Scripting (XSS) is a type of security vulnerability that allows an attacker to inject malicious scripts or HTML code into a website, which is then executed by the victim's browser. This can lead to various attacks, such as stealing sensitive information or performing actions on behalf of the user.
An attacker can exploit this vulnerability by injecting a crafted payload into the 'facid' parameter of the 'card.php' file in Dolibarr. This payload will be reflected back to the user's browser, potentially allowing the execution of arbitrary web script or HTML.
Yes, the vulnerability can be fixed by upgrading Dolibarr to version 19.0.2 or later. This version includes a patch that properly sanitizes user input, preventing the execution of injected scripts or HTML.
If upgrading to the latest version is not immediately possible, a temporary workaround is to manually sanitize the 'facid' parameter before using it in the application. This can be done by using appropriate input validation and sanitization techniques, such as HTML encoding or using a library that provides protection against XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
