This host is running Dolibarr and is prone to multiple cross site scripting and SQL injection vulnerabilities.

Successful exploitation will allow attacker to execute arbitrary HTML and script code in a user's browser session in the context of a vulnerable site and to cause SQL Injection attack to gain sensitive information. Impact Level: Application

Upgrade to Dolibarr version 3.1RC3 or later For updates refer to http://www.dolibarr.org/

The flaws are due to improper validation of user-supplied input - Passed via PATH_INFO to multiple scripts allows attackers to inject arbitrary HTML code. - Passed via the 'sortfield', 'sortorder', 'sall', 'id' and 'rowid' parameters to multiple scripts, which allows attackers to manipulate SQL queries by injecting arbitrary SQL code.

Dolibarr version 3.1.0RC and prior

• http://osvdb.org/77339
• http://seclists.org/bugtraq/2011/Nov/144
• http://www.securityfocus.com/archive/1/520619
• https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_dolibarr.html

---

Updated on 2015-03-25