CVE-2021-33816: Dolibarr 13.0.2 Remote PHP Code Execution Vulnerability
Summary
CVE-2021-33816: The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked. Affects dolibarr versions >= 13.0.2, <= 13.0.2. No fix is published. How to fix ↓
Also tracked for
- dolibarr/dolibarr · Packagist
The same CVE-2021-33816 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM solution designed for small and medium businesses. It offers a range of functionalities including invoicing, project management, and customer relationship management. The website builder module in Dolibarr allows users to create and manage web content easily. However, a critical vulnerability has been identified in version 13.0.2, which exposes the system to remote code execution risks.
Vulnerability Detail
The vulnerability arises from an incomplete protection mechanism in the website builder module of Dolibarr 13.0.2. While functions like system, exec, and shell_exec are blocked, the use of backticks is not restricted. This oversight allows an attacker to execute arbitrary PHP code remotely, potentially leading to complete system compromise. The ramifications include unauthorized access to sensitive data, manipulation of the application, and disruption of services.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the website builder module until a patch is applied. This can be done by navigating to the Dolibarr settings and unchecking the website builder option.
Conclusion
The vulnerability identified as CVE-2021-33816 in Dolibarr 13.0.2 poses a significant risk due to its potential for remote PHP code execution. Users are strongly advised to update to a patched version or disable the affected module until a fix can be applied. Regular monitoring and vulnerability management practices, such as those offered by Vulert, can help maintain the security of your applications.
See every vulnerability recorded for dolibarr →
FAQ
CVE-2021-33816 is a vulnerability in Dolibarr 13.0.2 that allows remote PHP code execution due to inadequate input validation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive data, potential data loss, and the ability for attackers to execute arbitrary commands on the server.
Yes, users should upgrade to a version of Dolibarr later than 13.0.2 to mitigate this vulnerability.
If an immediate update is not possible, consider disabling the website builder module as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr.
