Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE: this is disputed by a third party who indicates that exploitation can only occur if an unprivileged user knows the token of an admin user.
The vulnerability concerns the notes field in the perms.php file and involves the lack of proper verification of user-initiated requests (CSRF, CWE-352). An attacker could trick a logged-in administrator into executing a crafted request, which could potentially allow modification of permissions. According to a third-party caveat, the attack is possible only when an unprivileged user already possesses an administrator session token, which significantly narrows the actual threat scenario. The classification also includes CWE-284 (improper access control) and CWE-598 (data exposure through GET parameters).
In case of successful exploitation, an attacker could perform privilege escalation in the Dolibarr system, potentially gaining full control over the ERP/CRM application. The effectiveness of the attack is disputed and depends on prior acquisition of an administrative session token.
Patches available from the vendor should be applied in accordance with the references. It is also recommended to implement additional CSRF protection mechanisms (e.g., anti-CSRF tokens), restrict access to the administrative panel, and regularly audit user permissions.
Dolibarr ERP & CRM version 22.0.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H