CVE-2021-33618: 
PHP vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability was discovered in Dolibarr ERP & CRM version 13.0.2. The vulnerability (CVE-2021-33618) was identified when the application failed to properly escape 'greater than' and 'smaller than' characters in object detail pop-up windows. The issue was discovered by Trovent Security GmbH and Nick Decker (Trovent Advisory).

The vulnerability exists due to improper sanitization of user input in the object details feature, specifically in the user-management functionality. An attacker could exploit this by injecting HTML tags and attributes, demonstrated through the use of a 'body' tag with an 'onpointermove' attribute to execute arbitrary JavaScript code. The vulnerability has been assigned a CVSS score of 9.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) indicating critical severity (NVD, Trovent Advisory).

The vulnerability allows attackers to execute arbitrary JavaScript code in the context of other users' browsers who view the manipulated object details. This could lead to session hijacking, credential theft, and other malicious actions performed in the context of the affected users (Trovent Advisory).

The vulnerability was fixed in Dolibarr version 14.0.0. Organizations running affected versions should upgrade to version 14.0.0 or later (Dolibarr Releases).