PT-2021-20233 · Unknown · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP and CRM version 13.0.2 Description: The issue allows for stored cross-site scripting XSS in the object details of the user-management feature. This can be demonstrated by using and characters in the onpointermove attribute of a...

Dolibarr ERP/CRM 跨站脚本漏洞

Dolibarr ERP...

Dolibarr 代码注入漏洞

Dolibarr is a software application. A modern software package to help manage your organization's activities. A security vulnerability exists in Dolibarr 13.0.2 that allows an attacker to remotely execute PHP code...

Dolibarr ERP / CRM 13.0.2 Remote Code Execution Vulnerability

Authenticated remote code execution in Dolibarr ERP & CRM Overview Advisory version: 1.0 Advisory status: Public Affected product: Dolibarr ERP & CRM Tested versions: Dolibarr 13.0.2 Vendor: Dolibarr foundation, https://www.dolibarr.org Credits: Trovent Security GmbH, Nick Decker Detailed...

Dolibarr ERP / CRM 13.0.2 Cross Site Scripting

Trovent Security Advisory 2105-02 Stored cross-site scripting in Dolibarr ERP & CRM Overview Advisory ID: TRSA-2105-02 Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2105-02 Affected product: Dolibarr ERP & CRM Tested versions: Dolibarr 13.0.2...

Dolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege Escalation

Exploit Title: Dolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting XSS / Privilege Escalation Exploit Author: Oscar Gutierrez m4xp0w3r Date: 18/10/2021 Vendor Homepage: https://www.dolibarr.org/ Software Link: https://github.com/Dolibarr Tested on: Ubuntu, LAAMP Vendor: Dolibarr Version: v14.0....

Dolibarr ERP / CRM 14.0.2 Cross Site Scripting / Privilege Escalation

Exploit Title: Dolibarr ERP & CRM v14.0.2 Stored XSS / Privilege Escalation Exploit Author: Oscar Gutierrez m4xp0w3r Date: October 9, 2021 Vendor Homepage: https://www.dolibarr.org/ Software Link: https://github.com/Dolibarr Tested on: Ubuntu, LAAMP Vendor: Dolibarr Version: v14.0.2 Exploit...

Dolibarr ERP / CRM 14.0.2 Cross Site Scripting / Privilege Escalation Vulnerabilities

Dolibarr ERP and CRM 14.0.2 suffers from a persistent cross site scripting vulnerability that enables privilege escalation. Exploit Title: Dolibarr ERP & CRM v14.0.2 Stored XSS / Privilege Escalation Exploit Author: Oscar Gutierrez m4xp0w3r Vendor Homepage: https://www.dolibarr.org/ Software Link...

Dolibarr ERP / CRM 14.0.2 Cross Site Scripting / Privilege Escalation

Exploit Title: Dolibarr ERP & CRM v14.0.2 Stored XSS / Privilege Escalation Exploit Author: Oscar Gutierrez m4xp0w3r Date: October 9, 2021 Vendor Homepage: https://www.dolibarr.org/ Software Link: https://github.com/Dolibarr Tested on: Ubuntu, LAAMP Vendor: Dolibarr Version: v14.0.2 Exploit...

The vulnerability of the WYSIWYG Editor module of the Dolibarr resource planning and customer relationship management system allows a hacker to gain access to the administrator account.

The vulnerability of the WYSIWYG Editor module in the Dolibarr system for resource planning and managing customer relationships exists due to the lack of security measures for the website structure. Exploiting this vulnerability allows a malicious actor to remotely gain control of the administrat...

The vulnerability of Dolibarr’s system for planning enterprise resources and managing customer relationships is related to lack of access control. This allows attackers to compromise the integrity of the protected information.

The vulnerability of Dolibarr’s system for resource planning and managing relationships with customers is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to influence the integrity of the protected information...

GHSA-FJQG-W8G6-HHQ8 Dolibarr vulnerable to Improper Authentication and Improper Access Control

In Dolibarr application, v3.3.beta120121221 to v13.0.2 have Modify access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user Login. This leads to complete account takeover of the victim user. This happens since the...

Dolibarr vulnerable to Improper Authentication and Improper Access Control

In Dolibarr application, v3.3.beta120121221 to v13.0.2 have Modify access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user Login. This leads to complete account takeover of the victim user. This happens since the...

GHSA-C32W-3CQH-F6JX Weak Password Recovery Mechanism for Forgotten Password

In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password...

Dolibarr ERP/CRM 14.0.1 Privilege Escalation

Exploit Title: Dolibarr ERP/CRM 14.0.1 - Privilege Escalation Date: April 8, 2021 Exploit Author: Vishwaraj101 Vendor Homepage: https://www.dolibarr.org/ Affected Version: = 14.0.1 Patch: https://github.com/Dolibarr/dolibarr/commit/489cff46a37b04784d8e884af7fc2ad623bee17d Summary: Using the below...

Dolibarr ERP 14.0.1 - Privilege Escalation

Exploit Title: Dolibarr ERP/CRM 14.0.1 - Privilege Escalation Date: April 8, 2021 Exploit Author: Vishwaraj101 Vendor Homepage: https://www.dolibarr.org/ Affected Version: = 14.0.1 Patch: https://github.com/Dolibarr/dolibarr/commit/489cff46a37b04784d8e884af7fc2ad623bee17d Summary: Using the below...

Dolibarr ERP / CRM 14.0.1 - Privilege Escalation Vulnerability

Exploit Title: Dolibarr ERP/CRM 14.0.1 - Privilege Escalation Exploit Author: Vishwaraj101 Vendor Homepage: https://www.dolibarr.org/ Affected Version: = 14.0.1 Patch: https://github.com/Dolibarr/dolibarr/commit/489cff46a37b04784d8e884af7fc2ad623bee17d Summary: Using the below chain of issues...

Dolibarr Cross-site Scripting vulnerability

In Dolibarr ERP CRM, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the Private Note field at /adherents/note.php?id=1 endpoint. These scripts are executed in a victim’s browser when th...

GHSA-CPV8-6XGR-RMF6 Dolibarr Cross-site Scripting vulnerability

In Dolibarr ERP CRM, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the Private Note field at /adherents/note.php?id=1 endpoint. These scripts are executed in a victim’s browser when th...

Privilege Escalation

dolibarr/dolibarr is vulnerable to privilege escalation. A user with an admin level privilege is able to change other users details but fails to validate already existing “Login” name, while renaming the user “Login”, leading to a complete account takeover of the victim user...