PT-2014-5658 · Dolibarr · Dolibarr Erp/Crm

Publicado 2014-07-11 · Atualizado 2022-11-17 · CVE-2014-3991

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM version 3.5.3

Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters to different PHP files, including index.php, user/index.php, user/logout.php, user/fiche.php, and viewimage.php. The vulnerable parameters include dol use jmobile, dol optimize smallscreen, dol no mouse hover, dol hide topmenu, dol hide leftmenu, mainmenu, leftmenu, email, firstname, job, lastname, login, modulepart, and file.

Recommendations For Dolibarr ERP/CRM version 3.5.3, consider disabling the vulnerable parameters until a patch is available. Restrict access to the affected PHP files to minimize the risk of exploitation. Avoid using the parameters dol use jmobile, dol optimize smallscreen, dol no mouse hover, dol hide topmenu, dol hide leftmenu, mainmenu, leftmenu, email, firstname, job, lastname, login, modulepart, and file in the affected API endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-3991

Produtos afetados

Dolibarr Erp/Crm

Referências · 3

• 🔥 http://packetstormsecurity.com/files/127389/Dolibarr-CMS-3.5.3-SQL-Injection-Cross-Site-Scripting.html · Exploit
• 🔥 https://exploit-db.com/exploits/34007 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-3991 · Nota de Segurança