Description

Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.

Remediation

References

CVE-2022-40871

Related Vulnerabilities

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-6734)

PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-1635)

MySQL CVE-2016-0640 Vulnerability (CVE-2016-0640)

Apache Tomcat Improper Input Validation Vulnerability (CVE-2013-4322)

MySQL CVE-2017-10283 Vulnerability (CVE-2017-10283)

Severity

Critical

Classification

CVE-2022-40871 CWE-276 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities