CVE-2020-13828

Vulnerability

Details

CVE-2020-13828 describes multiple stored Cross-Site Scripting (XSS) vulnerabilities in Dolibarr version 11.0.4 [1][3]. The root cause is insufficient sanitization of user-supplied input in several parameters across different modules. Specifically, the subject, message, and address parameters in ticket/card.php?action=create; the societe and address parameters in adherents/card.php; the label and customcode parameters in product/card.php; and the alias and barcode parameters in societe/card.php fail to properly encode or escape HTML, allowing storage of malicious scripts [2][3].

Exploitation

An attacker must be authenticated to the Dolibarr instance. By crafting a payload (e.g., a base64-encoded ` tag wrapped in an element) and submitting it through the vulnerable parameters, the payload is stored on the server [2]. When other users (including administrators) view the affected pages, the script executes in their browser context. The advisory from wizlynxgroup provides a concrete proof-of-concept using the label` parameter of the product card update request [2].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, defacement, data theft, or further malicious actions within the application [1][3]. Because the payload is stored, the attack can propagate to every user who accesses the compromised page.

Mitigation

Dolibarr 11.0.4 is the affected version. Users should upgrade to a later release that addresses these XSS vulnerabilities or apply input validation and output encoding as a workaround. As of the published advisory, no official patch had been announced, but users are advised to monitor the official Dolibarr repository [1] for fixes.