CVE-2023-4197

Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE

Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.

Affected

Dolibarr · Dolibarr ERP CRM

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 STARLABS

7.5 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

35.92% chance of exploitation in the next 30 days, 98th percentile

Published

2023-11-01

Updated

2024-09-05

Proof-of-concept exploits (2)

• alien-keric/CVE-2023-41970★ · 2024-05-25
• alienkeric/CVE-2023-41970★ · 2024-05-25

Security advisories

• https://starlabs.sg/advisories/23/23-4197
• advisories/GHSA-r9cm-pw9j-3fpx
• Dolibarr/dolibarr/commit/0ed6a63fb06be88be5a4f8bcdee83185eee4087e

References

• CVE Record
• NVD entry

Related

• CVE-2012-2982
• CVE-2022-30190