CVE-2017-8879

Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation...

CVE-2017-7886

Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter...

CVE-2017-7887

CVE-2017-7887 concerns Dolibarr ERP/CRM 4.0.4 with a reported Cross‑Site Scripting (XSS) in the file doli/societe/list.php via the sall parameter. Multiple connected sources corroborate this vulnerability, including NVD and OSV entries citing the same flaw. The vulnerability is described as XSS w...

CVE-2017-7886

CVE-2017-7886 affects Dolibarr ERP/CRM 4.0.4, where an SQL injection is possible in doli/theme/eldy/style.css.php via the lang parameter. The available documents confirm the vulnerability class and the affected component but do not provide remediation details or patch/version fixes. The CVSS attr...

CVE-2017-7886: Improper Neutralization of Special Elements used in an SQL Command

Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter...

CVE-2017-7888: Inadequate Encryption Strength

Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier...

CVE-2017-8879: Improper Authentication

Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation...

CVE-2017-7887: Improper Neutralization of Input During Web Page Generation

Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter...

PT-2017-17975 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 4.0.4 Description: The issue concerns the use of the MD5 algorithm for password storage, which can facilitate brute-force attacks. Recommendations: For version 4.0.4, consider updating the password storage mechanism t...

Dolibarr 4.0.4 SQL Injection / XSS / Weaknesses

=== FOXMOLE - Security Advisory 2017-02-23 === Dolibarr ERP & CRM - Multiple Issues Affected Versions ================= Dolibarr 4.0.4 Issue Overview ============== Vulnerability Type: SQL Injection, Cross Site Scripting, Weak Hash Algorithm without Salt, Weak Password Change Method Technical Ris...

PT-2017-17973 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 4.0.4 Description: The issue is related to SQL Injection in the doli/theme/eldy/style.css.php file via the lang parameter. Recommendations: For version 4.0.4, avoid using the lang parameter in the affected file until...

PT-2017-18601 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 4.0.4 Description: The issue allows password changes without requiring the current password, making it easier for attackers with physical access to obtain access via an unattended workstation. Recommendations: For...

Dolibarr CRM Command Injection

Exploit Title: Dolibarr CRM 3.9.1 - Command Injection Vulnerability Exploit Author: David Silveiro Exploit Author Github: github.com/davidsilveiro Exploit Author Twitter: twitter.com/davidsilveiro Vendor Homepage: https://www.dolibarr.org Software Link:...

Dolibarr CRM Cross Site Scripting

Exploit Title: Dolibarr CRM alert Search criteria ' alert ' into fields Third party name, Alias name, Custom…...

Multiple RCEs via CSRF in Dolibarr

High-Tech Bridge Security Research Lab discovered multiple CSRF vulnerabilities in a popular ERP and CRM software Dolibarr. Discovered vulnerabilities may allow remote attacker to run arbitrary commands on vulnerable system via CSRF vector. Successful exploitation of the vulnerabilities can lead ...

Multiple Cross-Site Scripting Vulnerabilities in Dolibarr ERP/CRM

Dolibarr ERP/CRM is the software that manages your company's business information. Multiple cross-site scripting vulnerabilities in Dolibarr ERP/CRM 3.8.3 and prior versions allow remote attackers to inject arbitrary web script or HTML via the url of an external calendar or the "Import External...

Multiple cross-site scripting vulnerabilities in Dolibarr ERP/CRM (CNVD-2016-00438)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system. The Dolibarr ERP/CRM htdocs/user/card.php script fails to adequately filter 'lastname', 'firstname', ' email', 'job', and 'signature' parameters, allowing remote attackers to exploit...

CVE-2016-1912

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lastname, 2 firstname, 3 email, 4 job, or 5 signature parameter to htdocs/user/card.php...

CVE-2016-1912

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lastname, 2 firstname, 3 email, 4 job, or 5 signature parameter to htdocs/user/card.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lastname, 2 firstname, 3 email, 4 job, or 5 signature parameter to htdocs/user/card.php...