Description

Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.

Remediation

References

CVE-2022-40871

Related Vulnerabilities

WordPress Plugin BuddyPress Customer.io Analytics Integration Cross-Site Request Forgery (1.1.6)

WordPress Plugin Woody ad snippets-Insert Header Footer Code, AdSense Ads Multiple Vulnerabilities (2.2.4)

WordPress Plugin Chat-Support Board-WordPress Chat Cross-Site Scripting (1.2.8)

WordPress Plugin Protected Posts Logout Button Security Bypass (1.4.5)

MongoDb Insufficiently Protected Credentials Vulnerability (CVE-2021-32039)

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-276 CVE-2022-40871