Dolibarr ERP CRM vulnerabilities

An issue in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/core/class/commonobject.class.php.

An issue in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/cron/class/cronjob.class.php, in the call_user_func_array() function.

An issue in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/core/actions_addupdatedelete.inc.php.

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contain an authenticated remote code execution vulnerability that allows authenticated administrators to execute arbitrary PHP code on the server.

Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, allowing remote attackers to obtain sensitive information.

Dolibarr ERP/CRM version 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context of the vulnerable application.

Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0, the ODT to PDF conversion process in odf.php concatenates the MAIN_ODT_AS_PDF configuration constant directly into a shell command passed to exec() without sanitization.

A vulnerability in Dolibarr ERP/CRM prior to version 23.0.2 allows authenticated attackers with administrator privileges to achieve remote code execution. The issue is in the dol_eval_standard() function, which fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax.

A Cross Site Scripting (XSS) vulnerability in Dolibarr ERP CRM version 17.0.1 and earlier allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject functions.

A vulnerability in Dolibarr ERP CRM version 17.0.1 and earlier allows a remote privileged attacker to execute arbitrary code via a crafted command or script.

Dolibarr ERP/CRM versions before 5.0.3 are vulnerable to SQL injection in user/index.php, in the search_supervisor and search_statut parameters.

Dolibarr ERP/CRM version 4.0.4 stores passwords using the MD5 algorithm, making brute-force attacks easier.

Dolibarr ERP/CRM version 4.0.4 has an SQL Injection vulnerability in doli/theme/eldy/style.css.php via the lang parameter.

Dolibarr ERP CRM up to version 23.0.2 has a vulnerability in the Legacy Filemanager component in the file htdocs/core/filemanagerdol/connectors/php/config.inc.php. An unknown function leads to improper authorization. The attack can be performed remotely, and the exploit is publicly available. A patch is available in version 23.0.3.

Dolibarr ERP CRM up to 23.0.1 has an improper authorization vulnerability in the checkUserAccessToObject function in the Leave Request API.

Dolibarr ERP CRM versions 23.0.0, 23.0.1, and 23.0.2 have a vulnerability in an unknown function in htdocs/user/messaging.php, where manipulation of the ID argument leads to authorization bypass. The attack can be executed remotely. The fix is available in version 23.0.3.

In the Website module of Dolibarr ERP & CRM version 22.0.4 and below, blacklist-based filtering is used to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code execution with the ability to execute arbitrary operating system commands on the server.

In Dolibarr ERP & CRM version 22.0.4 and earlier, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters. This allows an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.

Dolibarr ERP & CRM version 21.0.1 was found to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter.

An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to version 19.0.1 allows attackers to upload a crafted .SQL file, leading to arbitrary code execution on the server.

Lack of sanitization during the installation process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent network access to execute arbitrary code via a specially crafted input.

File upload vulnerability in Dolibarr ERP CRM version 17.0.1 and earlier allows a remote attacker to execute arbitrary code and obtain sensitive information by bypassing extension filtering and renaming functions.