CVE-2018-25357

Critical

Published: 23/05/2026(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Dolibarr ERP CRM version 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.

Risk Assessment

This vulnerability poses a serious risk to organizations, allowing attackers to remotely execute code, which can lead to system takeover. This may result in data loss, privacy breaches, and other severe consequences.

Recommendation

It is recommended to update Dolibarr ERP CRM to the latest version to eliminate this vulnerability. Additionally, implementing proper security measures such as input validation and network traffic monitoring is advisable.

Original NVD description (English source)

Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.