Executive brief
Dolibarr ERP CRM, a popular open-source suite for managing business operations like invoicing and inventory, contains a critical security flaw. An unauthenticated attacker can remotely execute malicious commands on the server by exploiting the installation script. This could lead to a total takeover of the system, resulting in the theft of sensitive business data, service disruption, or a complete compromise of the corporate network.
Technical details
A remote code execution (RCE) vulnerability exists in Dolibarr ERP CRM due to improper input validation in the 'db_name' parameter within the 'install/step1.php' script. An unauthenticated attacker can inject malicious PHP code into this parameter via a POST request. Once injected, the attacker can trigger the execution of this code by accessing the 'check.php' endpoint and passing system commands through the 'cmd' GET parameter. This allows for full system compromise with the privileges of the web server. The issue is patched in versions 6.0.8 and 7.0.4.
Affected products
- Dolibarr Dolibarr ERP CRM >= 7.0.0, <= 7.0.3; < 6.0.8
Timeline
- 2018-05-23: disclosed: Initial vulnerability discovery/exploit publication date based on CVE-2018-25357 and Exploit-DB references.
- 2026-05-23: advisory: NVD publication date.
- 2026-05-26: advisory: GitHub Advisory published.