CVE-2018-10092: Dolibarr arbitrary commands execution
Summary
CVE-2018-10092: Dolibarr arbitrary commands execution. Affects dolibarr/dolibarr versions < 7.0.2. Fixed in 7.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM software package designed for small and medium-sized businesses. It provides a range of features including accounting, inventory management, project management, and more. Dolibarr is widely used due to its flexibility and ease of use. However, a vulnerability has been discovered in versions prior to 7.0.2 that allows remote attackers to execute arbitrary commands. This vulnerability arises from a flaw in the admin panel, specifically in the antivirus command and parameters used to scan file uploads.
Vulnerability Detail
The vulnerability in Dolibarr allows remote attackers to execute arbitrary commands on the affected system. By exploiting the flaw in the admin panel, an attacker can manipulate the antivirus command and parameters used for scanning file uploads. This can lead to the execution of arbitrary commands with the privileges of the Dolibarr application. The impact of this vulnerability can be severe, as it allows an attacker to gain unauthorized access, compromise data, and potentially take control of the affected system.
How To Fix
Minimum fixed version
7.0.2
This is the first release that contains the fix.
composer require dolibarr/dolibarr:7.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Dolibarr to the latest version to mitigate the risk of arbitrary command execution.
Conclusion
The vulnerability in Dolibarr prior to version 7.0.2 allows remote attackers to execute arbitrary commands. To mitigate this risk, it is crucial to update Dolibarr to the latest version and regularly apply software updates. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM software package designed for small and medium-sized businesses. It provides various features such as accounting, inventory management, and project management.
This vulnerability allows remote attackers to execute arbitrary commands on the affected system. It can lead to unauthorized access, data compromise, and potential control of the system.
To fix this vulnerability, update Dolibarr to version 7.0.2 or later. Regularly updating software is crucial to protect against known vulnerabilities.
No, there is no known workaround for this vulnerability. Updating Dolibarr to the latest version is the recommended solution.
For more information about this vulnerability, you can visit the Dolibarr GitHub repository or contact the Dolibarr support team.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
