Dolibarr
CVE-2018-10092
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads.
AnalysisAI
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Technical ContextAI
This vulnerability is classified as Missing Authorization (CWE-862), which allows attackers to access resources or perform actions without proper authorization checks. The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads. Affected products include: Dolibarr. Version information: before 7.0.2.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Implement role-based access control, validate authorization on every request server-side, apply principle of least privilege.
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vecto
Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code executio
Improper authorization in Dolibarr's Members REST API (all versions before 24.0.0) allows any authenticated user holding
Incorrect authorization in Dolibarr's payments REST API delete endpoint exposes all payment records to deletion by any a
SQL injection in Dolibarr ERP/CRM through version 23.0.3 lets authenticated REST API users exfiltrate arbitrary database
Improper authorization in Dolibarr's expense report REST API update endpoint allows authenticated users with only expens
Dolibarr's Members REST API before version 24.0.0 exposes bcrypt password hash verifiers to any authenticated user holdi
SQL injection in Dolibarr's users REST API (all versions before 24.0.0) allows authenticated users holding only user-rea
Dolibarr's REST API user-update endpoint permits any low-privileged account holding user-write rights to overwrite payro
Broken object-level authorization (BOLA) in Dolibarr's REST API bank account write routes permits any authenticated user
Broken object-level authorization (BOLA) in Dolibarr's REST API write routes for third-party site accounts allows any au
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbi
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today