Headline
CVE-2017-1000509: Stored Cross-site scripting (XSS) in product page · Issue #7727 · Dolibarr/dolibarr
Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript code.
Bug
Stored Cross-site scripting (XSS) using product page, bypassing XSS detection
Environment
- Version: 6.0.2
- OS: Ubuntu
- Web server: Apache
- PHP: 7.0
- Database: MySQL
- URL(s): product/card.php?id=1929&mainmenu=home
Expected and actual behavior****Expected behaviour
XSS detector picks up on the payload and refuses to save it
Actual behaviour
XSS payload is saved with no interference from the detector. When visiting the page later, the payload executes.
Steps to reproduce the behavior
- Log into Dolibarr with a user who can edit the name of a product
- Choose a product (this products name will be changed FYI), and click on the modify details button
- Append the following payload to the product’s current name: <iframe/src="data:text/html; base64 ,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">
Suggested implementation
Change the detector to now pick up on similar payloads (including this one)