CVE-2021-25955: 
PHP vulnerability analysis and mitigation

In Dolibarr ERP CRM's WYSIWYG Editor module, versions 2.8.1 to v13.0.2 are affected by a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and disclosed on August 15, 2021, and received a CVSS v3.1 score of 9.0 (CRITICAL) (NVD).

The vulnerability allows low-privileged application users to store malicious scripts in the 'Private Note' field at the '/adherents/note.php?id=1' endpoint. These scripts are executed in a victim's browser when they open the page containing the vulnerable field. The vulnerability is particularly severe when combined with an Improper Access Control vulnerability on Private notes, as it could lead to privilege escalation (WhiteSource).

When exploited, the vulnerability can lead to full account takeover, particularly if the victim is a highly privileged administrator. The injected scripts can extract the Session ID, which combined with other vulnerabilities related to Private notes access control, enables privilege escalation for low-privileged users (WhiteSource).

The recommended mitigation is to upgrade to Dolibarr version 14.0.0 or later. A security patch was implemented to enhance the sanitizing of input, as evidenced by the commit that addresses the vulnerability (GitHub Commit).