Description
In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.
Remediation
References
Related Vulnerabilities
WordPress Plugin Kimili Flash Embed Unspecified Vulnerability (2.2.1)
WordPress 4.8.x Prototype Pollution (4.8 - 4.8.18)
WordPress 3.4.1 Multiple Vulnerabilities (2.0 - 3.4.1)
phpMyAdmin Cryptographic Issues Vulnerability (CVE-2016-9847)
Podcast Generator Server-Side Request Forgery (SSRF) Vulnerability (CVE-2023-53899)