PT-2022-25596 · Unknown · Dolibarr Erp/Crm

Published 2022-10-12 · Updated 2025-04-03 · CVE-2022-40871

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dolibarr ERP & CRM versions <=15.0.3

Description The issue allows malicious code to be inserted into the database and then executed by eval. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, this can lead to eval injection.

Recommendations For versions <=15.0.3, update to a version higher than 15.0.3 to resolve the issue. As a temporary workaround, consider restricting access to the installation page of dolibarr to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

Related Identifiers

BIT-DOLIBARR-2022-40871

CVE-2022-40871

GHSA-7CM4-VMF2-8WF2

Affected Products

Dolibarr Erp/Crm

References · 10

• 🔥❌ https://github.com/youncyb/dolibarr-rce · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2022-40871 · Security Note
• https://osv.dev/vulnerability/GHSA-7cm4-vmf2-8wf2 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dolibarr-2022-40871 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-40871 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-40871 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40871 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-40871 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note
• https://t.me/cibsecurity/51262 · Telegram Post