CVE-2017-1000509

Vulnerability

Dolibarr version 6.0.2 contains a stored Cross-Site Scripting (XSS) vulnerability in the product details page (product/card.php). The flaw resides in the product name field, where the input sanitization fails to detect certain XSS payloads, allowing malicious scripts to be saved and later executed [3]. Any user with permission to edit a product's name can exploit this [3].

Exploitation

An attacker must have a valid Dolibarr account with privileges to modify product details [3]. The attacker logs in, navigates to a product, clicks the modify button, and appends a crafted XSS payload (e.g., <iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">) to the product's name [3]. The payload bypasses the built-in XSS detector and is stored in the database. When any user visits the product page, the payload executes in their browser [3].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, defacement, theft of sensitive data, or other malicious actions performed on behalf of the authenticated victim [3]. The attack does not escalate to server-side code execution but compromises the confidentiality and integrity of affected user sessions.

Mitigation

No official patch has been released for this version. As of the available references, the suggested mitigation is to upgrade to a later Dolibarr version that includes improved XSS filtering [3]. Administrators should restrict product edit permissions to trusted users and review the input validation mechanisms. The vulnerability is not listed in the CISA KEV as of this writing.