PT-2024-27767 · Unknown · Dolibarr Erp/Crm

Arthur Valverde M + 1 · Published 2024-06-18 · Updated 2025-06-14 · CVE-2024-37821

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dolibarr ERP CRM versions up to 19.0.1

Description The issue concerns an arbitrary file upload vulnerability in the Upload Template function. This vulnerability allows attackers to execute arbitrary code by uploading a crafted .SQL file.

Recommendations For versions up to 19.0.1, consider disabling the Upload Template function until a patch is available to prevent exploitation. Restrict access to the Upload Template feature to minimize the risk of arbitrary code execution.

Exploit

Fix

Code Injection

Unrestricted File Upload

Weakness Enumeration

CWE-94

CWE-434

Related Identifiers

BIT-DOLIBARR-2024-37821

CVE-2024-37821

GHSA-P7R8-7W87-8G46

Affected Products

Dolibarr Erp/Crm

References · 7

• 🔥 https://github.com/alexbsec/CVEs/blob/master/2024/CVE-2024-37821.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-37821 · Security Note
• https://osv.dev/vulnerability/GHSA-p7r8-7w87-8g46 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37821 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dolibarr-2024-37821 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note
• http://dolibarr.com · Note