Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
4.3
CVSSv2

CVE-2011-4814

Published: 14/12/2011 Updated: 10/02/2023
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 435
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Subscribe to Dolibarr Erp\/crm

Vulnerability Summary

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote malicious users to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php, (2) admin/boxes.php, (3) comm/clients.php, (4) commande/index.php; and the optioncss parameter to (5) admin/ihm.php and (6) user/home.php.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

dolibarr dolibarr erp\\/crm 2.9.0

dolibarr dolibarr erp\\/crm 2.8.1

dolibarr dolibarr erp\\/crm

dolibarr dolibarr erp\\/crm 2.6.0

dolibarr dolibarr erp\\/crm 3.0.0

dolibarr dolibarr erp\\/crm 2.7.1

dolibarr dolibarr erp\\/crm 2.6.1

dolibarr dolibarr erp\\/crm 2.5.0

dolibarr dolibarr erp\\/crm 2.7.0

dolibarr dolibarr erp\\/crm 2.8.0

dolibarr dolibarr erp\\/crm 3.0.1

Exploits

Exploit DB: Dolibarr ERP/CRM 3.1 - Multiple Script URI Cross-Site Scripting Vulnerabilities
source: wwwsecurityfocuscom/bid/50777/info Dolibarr is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compr ...

References

CWE-79http://www.osvdb.org/77339https://github.com/Dolibarr/dolibarr/commit/d08d28c0cda1f762a47cc205d4363de03df16675https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_dolibarr.htmlhttps://github.com/Dolibarr/dolibarr/commit/c539155d6ac2f5b6ea75b87a16f298c0090e535ahttps://github.com/Dolibarr/dolibarr/commit/63820ab37537fdff842539425b2bf2881f0d8e91http://www.securityfocus.com/bid/50777https://github.com/Dolibarr/dolibarr/commit/762f98ab4137749d0993612b4e3544a4207e78a1http://www.securityfocus.com/archive/1/520619/100/0/threadedhttps://nvd.nist.govhttps://www.exploit-db.com/exploits/36330/
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-3581reflected XSSCVE-2024-26925CVE-2024-27956LFICVE-2024-3607CVE-2024-3107CVE-2024-3295SQL
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook