Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE
CVE-2023-4197

7.5HIGH

Key Information:

Vendor

Dolibarr

Status
Dolibarr Erp Crm
Vendor
CVE Published:
1 November 2023

Badges

👾 Exploit Exists🟣 EPSS 32%

What is CVE-2023-4197?

An improper input validation flaw in Dolibarr ERP CRM up to version 18.0.1 allows attackers to inject and execute arbitrary PHP code by manipulating user-supplied input during the website creation process. This vulnerability could lead to unauthorized access and manipulation of the application, potentially compromising sensitive data and application integrity. Users are encouraged to apply the latest patches to mitigate the risks associated with this vulnerability.

Affected Version(s)

Dolibarr ERP CRM 0 <= 18.0.1

References

https://starlabs.sg/advisories/23/23-4197
third-party-advisory
https://github.com/Dolibarr/dolibarr/commit/0ed6a63fb06be...
patch

EPSS Score

32% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Poh Jia Hao (@Chocologicall) of STAR Labs SG Pte. Ltd. (@starlabs_sg)
.