CVE-2018-25357
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk75th percentile - higher than 75% of all known CVEs
Summary
Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.
Risk Assessment
An unauthenticated attacker can remotely execute arbitrary code on the server, potentially leading to full system compromise and data disclosure.
Recommendation
Upgrade Dolibarr ERP CRM to the latest version or apply available security patches immediately.
Original NVD description (English source)
Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.