HTML Injection

[naxonez]

[*] Page affected

• dolibarr-3.7.0/htdocs/societe/societe.php
• dolibarr-3.7.0/htdocs/societe/admin/societe.php

[*] Fields affected

• Bussiness Search (search_nom)

[*] Poc
You only need to inject the script code in this field like a:

"> < img src='http://www.xxx.com >

[rdoursenaud]

All left menu search fields are affected! (Contacts, products, members…)

This would allow to craft a malicious URL embedding a nasty script.

Good catch!

[naxonez]

Thanks!!

I hope that this help you to increase the security of this product :))

Regards.

[rdoursenaud]

Versions 3.5 and 3.6 also affected!

[rdoursenaud]

This is everywhere. Will take a bit of time to fix'em all…

[eldy]

Patch was merged so i close the bug