CVE-2017-17971

The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS.

Score

CVSS 3.0 6.1 Medium

Status

Modified - cve@mitre.org

Published

2017-12-29

Last modified

2024-09-17

Weaknesses

CWE-79

Affected products

• Dolibarr Erp/crm (Dolibarr)

References

• https://github.com/Dolibarr/dolibarr/issues/8000