dolibarr HTML Injection

🗓️ 13 Jan 2016 00:00:00Reported by NaxoneZType

packetstorm🔗 packetstormsecurity.com👁 32 Views

HTML Injection vulnerability in dolibarr software, allowing untrusted data injection in text fields such as external calendar URL and bank's name

Reporter	Title	Published	Views	Family All 9
CNVD	Multiple Cross-Site Scripting Vulnerabilities in Dolibarr ERP/CRM	21 Jan 201600:00	–	cnvd
CVE	CVE-2015-8685	15 Jan 201619:00	–	cve
Cvelist	CVE-2015-8685	15 Jan 201619:00	–	cvelist
EUVD	EUVD-2015-8562	7 Oct 202500:30	–	euvd
NVD	CVE-2015-8685	15 Jan 201619:59	–	nvd
OSV	UBUNTU-CVE-2015-8685	15 Jan 201619:59	–	osv
Prion	Cross site scripting	15 Jan 201619:59	–	prion
UbuntuCve	CVE-2015-8685	15 Jan 201619:59	–	ubuntucve
Veracode	Cross-site Scripting	22 Sep 201708:00	–	veracode

`# Title: HTML Injection in dolibarr  
# Author: Sergio Galán - @NaxoneZ  
# Date: Dec 24,2015  
# Vendor Homepage: *http://www.dolibarr.es/ <http://www.dolibarr.es/>*  
# Vulnerable version: < 3.8.3  
# CVE: CVE-2015-8685  
  
  
Dolibarr no properly escape untrusted data to prevent injection in the  
text fields.  
  
  
Any examples of fields affected are the parameter url from external  
calendar or the bank's name field (maybe others can be affected).  
  
  
[*] Poc  
You only need to inject the script code in this field like a:  
  
"> < img src='http://www.xxx.com >  
  
  
More Info  
=======https://github.com/Dolibarr/dolibarr/issues/4291  
  
Fixed  
=======  
  
https://github.com/GPCsolutions/dolibarr/commit/0d3181324c816bdf664ca5e1548dfe8eb05c54f8  
  
  
`

13 Jan 2016 00:00Current

0.1Low risk

Vulners AI Score0.1

EPSS0.00212