p PatchFirst

CVE-2018-25357

CVE-2018-25357 · Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.

CVSS 9.3 · Critical · EPSS 1.7% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • dolibarr erp crm

    Versions
    • ≥ 0, ≤ 7.0.3: Affected (semver)

    No fix published

  • dolibarr/dolibarr Packagist

    Versions
    • 7.0.0
    • 7.0.1
    • 7.0.2
    • 7.0.3
    Affected ranges
    • ECOSYSTEM: ≥ 7.0.0, < 7.0.4

    Update to 7.0.4

  • dolibarr/dolibarr Packagist

    Versions
    • 3.6.0
    • 3.6.0-beta
    • 3.6.1
    • 3.6.2
    • 3.6.3
    • 3.6.4
    • 3.6.5
    • 3.6.6
    • 3.7.0
    • 3.7.1
    • 3.7.2
    • 3.7.3
    • 3.7.4
    • 3.8.0
    • 3.8.0-beta
    • 3.8.1
    • 3.8.2
    • 3.8.3
    • 3.8.4
    • 3.9.0
    • 3.9.0-rc
    • 3.9.0-rc2
    • 3.9.1
    • 3.9.2
    • 3.9.3
    • 3.9.4
    • 4.0.0
    • 4.0.0-beta
    • 4.0.0-rc
    • 4.0.0-rc2
    • 4.0.1
    • 4.0.2
    • 4.0.3
    • 4.0.4
    • 4.0.5
    • 4.0.6
    • 5.0.0
    • 5.0.0-beta
    • 5.0.0-rc1
    • 5.0.0-rc2
    • 5.0.1
    • 5.0.2
    • 5.0.3
    • 5.0.4
    • 5.0.5
    • 5.0.6
    • 5.0.7
    • 6.0.0
    • 6.0.0-beta
    • 6.0.0-rc
    • 6.0.1
    • 6.0.2
    • 6.0.3
    • 6.0.4
    • 6.0.5
    • 6.0.6
    • 6.0.7
    Affected ranges
    • ECOSYSTEM: < 6.0.8

    Update to 6.0.8

  • dolibarr Ubuntu:Pro:16.04:LTS

    Versions
    • 3.5.5+dfsg1-2
    • 3.5.7+dfsg1-1
    • 3.5.8+dfsg1-1
    • 3.5.8+dfsg1-1ubuntu1
    Affected ranges
    • ECOSYSTEM: < 3.5.8+dfsg1-1ubuntu1+esm1

    Update to 3.5.8+dfsg1-1ubuntu1+esm1

Original sources

Check your server →