Description

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticated attacker can cause an authenticated administrator to open a crafted URL to execute arbitrary JavaScript in that session and create a persistent administrator account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-24T19:16:49.520Z",
  "pubdate": "2026-08-24T19:16:49.520Z",
  "executiveSummary": "Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability located within the extra fields administration template.\nThe vulnerability arises because the type request parameter is directly echoed into an inline script block without proper JavaScript-context encoding.\nAdditionally, the application fails to emit a Content-Security-Policy header, lowering the barrier for script execution.\nAn unauthenticated attacker can exploit this weakness by inducing an authenticated administrator to interact with a maliciously crafted URL.\nSuccessful exploitation allows the execution of arbitrary JavaScript within the active administrator session.\nThe resulting impact enables the attacker to perform privileged actions, specifically the creation of a persistent administrator account, leading to full application takeover.",
  "technicalDetails": "Root Cause: The vulnerability is caused by improper output neutralization where the type request parameter is reflected directly into an inline script block within the extra fields administration template without JavaScript-context encoding. Furthermore, the absence of a Content-Security-Policy header permits the execution of injected script contexts.\nVulnerable Component: The extra fields administration template within Dolibarr.\nAffected Versions: Dolibarr versions prior to 24.0.0.\nAuthentication Requirements: Exploitation requires the victim to be authenticated as an administrator, though the initial request can originate from an unauthenticated attacker via a crafted URL.\nPrivilege Requirements: The target must hold administrator privileges, while the attacking vector requires no prior authentication.\nNetwork Exposure: The vulnerability is exploitable over the network via standard HTTP/HTTPS protocols.\nAttack Flow: An unauthenticated attacker crafts a malicious URL targeting the extra fields administration interface, incorporating a specially manipulated type request parameter designed to break out of the intended inline script context. The attacker delivers this URL to an authenticated administrator via social engineering or other delivery mechanisms. Upon clicking the link, the administrator's browser loads the crafted URL, causing Dolibarr to reflect the unsanitized type parameter directly into the inline script block. Because no Content-Security-Policy header restricts execution, the browser executes the arbitrary JavaScript supplied by the attacker within the context of the administrator's active session.\nPayload Behavior and Post-Exploitation Impact: The injected JavaScript executes with full administrative privileges within the victim's session. The script can perform automated actions against the Dolibarr application interfaces, ultimately leading to the unauthorized creation of a persistent administrator account, granting the attacker long-term access to the system."
}