GHSA-vxr9-p2xw-m8cfcritical9.8
Dolibarr remote PHP code execution
The advisory, in context
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
dolibarr/dolibarr Packagist
Ecosystem versions
From 13.0.2 before 14.0.0
Fixed in 14.0.0
4 explicitly affected versions
13.0.2, 13.0.3, 13.0.4, 13.0.5
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "13.0.2"
},
{
"fixed": "14.0.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"13.0.2",
"13.0.3",
"13.0.4",
"13.0.5"
]
}