Dolibarr ERP & CRM Website Module Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the Website module of Dolibarr ERP & CRM versions through 22.0.4. The issue arises because the application employs a blacklist-based filtering approach to block dangerous PHP functions that could execute system commands. However, an authenticated user with permission to edit PHP content can bypass this filtering. This exploitation allows for the execution of arbitrary operating system commands on the server.

Impact

Exploitation of this vulnerability leads to remote code execution on the server, allowing for arbitrary command execution. This could result in a full compromise of the web application, unauthorized access to sensitive data, and potential modification or deletion of data.