CyberRota Analysis
AI-GeneratedDolibarr versions prior to 24.0.0 are vulnerable to a reflected cross-site scripting (XSS) flaw in the extra fields administration template, where the type request parameter is improperly handled, allowing an attacker to inject malicious JavaScript. This vulnerability can lead to unauthorized actions, such as creating a persistent administrator account, if an authenticated administrator is tricked into visiting a crafted URL. Organizations using Dolibarr should prioritize patching this vulnerability to protect against potential exploitation by attackers.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticated attacker can cause an authenticated administrator to open a crafted URL to execute arbitrary JavaScript in that session and create a persistent administrator account.