CVE-2012-10059 Dolibarr ERP/CRM Post-Auth OS Command Injection
CriticalCVSS 9.4
EPSS 4.5%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sanitize the sql_compat parameter, allowing authenticated users to inject arbitrary system commands, resulting in remote code execution on the server.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Dolibarr Project ERP/CRM | <= 3.2.0 | No fix listed |
References
- raw.githubusercontent.com exploit
- www.exploit-db.com exploit
- www.exploit-db.com exploit
- seclists.org exploit technical-description
- www.dolibarr.org product
- www.vulncheck.com third-party-advisory