Description

I found a stored XSS in the admin/accountant.php, the field town, name, Accountant code can escape the double quote. In the path ‘dolibarr/htdocs/main.inc.php’ has a WAF, we can not inject any the javascript onxxx event. However, in the path dolibarr/htdocs/core/lib/functions.lib.php(line 6643), there is a statement:

$temp = preg_replace('/<+([a-z]+)/i', '\1', $temp);

We can use it to bypass the WAF by adding a < in the payload.

Proof of Concept

POST /dolibarr/htdocs/admin/accountant.php HTTP/1.1
...
...&town="on<click=alert(/xss/);"

The PoC Video