CVE-2019-19211: 
PHP vulnerability analysis and mitigation

Dolibarr ERP/CRM versions 3.0 through 10.0.4 contained a Reflected Cross-Site Scripting (XSS) vulnerability in the user/card.php file. The vulnerability was discovered on September 6, 2019, and was assigned CVE-2019-19211. The issue was related to insufficient filtering of multiple user input parameters (USD Advisory).

The vulnerability existed due to insufficient filtering of multiple parameters in the /dolibarr/htdocs/user/card.php file. The affected parameters included lastname, firstname, office_phone, user_mobile, office_fax, email, accountancy_code, signature, job, thm, tjm, salary, and weeklyhours. When these parameters were passed through URL parameters with malicious content, they were reflected back to users without proper sanitization, allowing for the execution of arbitrary JavaScript code (USD Advisory).

The vulnerability could allow attackers to execute arbitrary JavaScript code in the context of other users' browsers who visit specifically crafted URLs. This could lead to session hijacking, theft of sensitive information, or other client-side attacks (USD Advisory).

The vulnerability could be exploited by crafting specific URLs containing malicious JavaScript code in any of the affected parameters. The attack required proper URL encoding to be successful. An attacker would need to convince a user to click on a specially crafted URL to exploit this vulnerability (USD Advisory).

The vulnerability was fixed in Dolibarr version 10.0.4, released on November 27, 2019. Users should upgrade to this version or later to protect against this vulnerability. The fix involved implementing proper filtering of user input according to its usage (USD Advisory).