CVE-2024-23817— Dolibarr 安全漏洞

Dolibarr Application Home Page HTML injection vulnerability

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML Injection vulnerability in the Home page of the Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered content in the application's response. Specifically, I was able to successfully inject a new HTML tag into the returned document and, as a result, was able to comment out some part of the Dolibarr App Home page HTML code. This behavior can be exploited to perform various attacks like Cross-Site Scripting (XSS). To remediate the issue, validate and sanitize all user-supplied input, especially within HTML attributes, to prevent HTML injection attacks; and implement proper output encoding when rendering user-provided data to ensure it is treated as plain text rather than executable HTML.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Dolibarr 安全漏洞

Dolibarr是一个应用软件。一个现代软件包，可帮助管理您组织的活动。 Dolibarr 18.0.4版本存在安全漏洞，该漏洞源于应用程序的主页中存在 HTML 注入漏洞，允许攻击者注入任意 HTML 标签并操纵应用程序响应中呈现的内容。

N/A

N/A