| Package | Affected versions | Patched versions |
|---|---|---|
| dolibarr/dolibarr | < 9.0.3 | 9.0.3 |
| dolibarr erp/crm | = 9.0.1 |
Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the same page, which specifies the inclusion of dynamic content. Thus, a lower privileged user of the application can execute code under the context and permissions of the underlying web server.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free