CVE-2017-17971

The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which…

published December 29, 2017

CVSS
—
EPSS
1%
Percentile
62.6
In the wild
Unconfirmed
What it is

The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01011 · 62.6th percentile
Published
2017-12-29T18:00Z
EPSS history
Timeline
  • 29 DEC 18:00Z
    The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which…
    cvelistv5