Description

Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.

Remediation

References

CVE-2022-40871

Related Vulnerabilities

Apache Tomcat Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2013-6357)

PostgreSQL Other Vulnerability (CVE-2007-3279)

Internet Information Services Integer Overflow or Wraparound Vulnerability (CVE-2008-1446)

XWikiplatform Exposure of Private Personal Information to an Unauthorized Actor Vulnerability (CVE-2025-54125)

WordPress Plugin UserPro-Community and User Profile Cross-Site Scripting (4.9.33)

Severity

Critical

Classification

CVE-2022-40871 CWE-276 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities