Jiva

**Name of the Vulnerable Software and Affected Versions** Dolibarr ERP/CRM versions prior to 23.0.2 **Description** An authenticated remote code execution issue exists in the `dol eval standard()` function. The system fails to apply forbidden string checks when operating in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via `eval()`. The root cause is that the `$forbiddenphpstrings` blocklist is only enforced in blacklist mode, while the whitelist regex is blind to PHP dynamic callable syntax. **Recommendations** Update to version 23.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** EspoCRM versions prior to 9.3.4 **Description** The EspoCRM software contains a flaw due to the formula engine operating outside the field-level restriction layer, allowing writable access to fields marked as read-only, such as `Attachment.sourceId`. This allows modification of the `sourceId` via a formula, leading to a path traversal issue when the `getFilePath()` function is used without proper sanitization. An attacker can upload a webshell using chunked upload, poison the `.htaccess` file, and achieve Remote Code Execution (RCE) as the `www-data` user. Exploitation requires admin credentials and six requests. The vulnerable component is the formula engine and the `getFilePath()` function. The `sourceId` variable is directly concatenated into a file path without sanitization. **Recommendations** Update to EspoCRM version 9.3.4 or later.