CVE-2019-19212: 
PHP vulnerability analysis and mitigation

Dolibarr ERP/CRM versions 3.0 through 10.0.3 contains a Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts via the qty parameter to product/fournisseurs.php (product price screen) (CVE Mitre, NVD).

The vulnerability exists in the product price editing functionality, specifically in the /dolibarr/htdocs/product/fournisseurs.php file. The application fails to properly sanitize user input in the qty parameter, allowing for SQL injection attacks. The vulnerability has been assigned a CVSS v3.1 score of 9.8 (CRITICAL) (NVD, USD HeroLab).

This vulnerability allows attackers to execute arbitrary SQL commands through the qty parameter manipulation. An attacker could potentially read sensitive database information, modify database contents, or execute other malicious database operations (USD HeroLab).

The vulnerability can be exploited by sending a specially crafted POST request to the product/fournisseurs.php endpoint with a malicious payload in the qty parameter. A proof of concept exists demonstrating how to extract the current database user information (USD HeroLab).

The vulnerability was fixed in Dolibarr version 10.0.3. The recommended mitigation is to upgrade to this version or later. For proper security, it is recommended to use prepared statements instead of building SQL queries by hand, as blacklist filtering attempts are not recommended due to their complexity (USD HeroLab).