GitHub Advisoryadvisory · Packagist

GHSA-7cm4-vmf2-8wf2 Dolibarr vulnerable to Eval Injection

CRITICAL Published 2022-10-12 Modified 2022-10-18 Official page ↗
Aliases
CVE-2022-40871
Ecosystem
Packagist
Packages
dolibarr/dolibarr
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94, CWE-95
Reviewed
2022-10-12

Affected packages

• Packagist dolibarr/dolibarr: <= 15.0.3 (no fix yet)

Description

Dolibarr ERP & CRM <=15.0.3 are vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.

Related

Alias · CVE (1)

  • CVE-2022-40871 Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. vulnerability

Weakness · CWE (2)

  • CWE-94 Improper Control of Generation of Code weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References