Description
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.
Remediation
References
Related Vulnerabilities
OpenSSL NULL Pointer Dereference Vulnerability (CVE-2004-0079)
Oracle Application Server CVE-2008-0340 Vulnerability (CVE-2008-0340)
WordPress Other Vulnerability (CVE-2007-2821)
Prototype Improper Privilege Management Vulnerability (CVE-2020-7993)
TYPO3 Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2013-4321)