Detection Guidance

This vulnerability can be detected by identifying if your Dolibarr ERP/CRM installation is running versions v22.0.0 through v22.0.4 or v24.0.0-alpha, which are known to be affected.

Detection involves checking for the presence of the vulnerable file `htdocs/core/actions_addupdatedelete.inc.php` and the usage of the `dol_eval()` function within it.

You can search for the vulnerable code by running commands such as:

• grep -r "dol_eval" /path/to/dolibarr/htdocs/core/actions_addupdatedelete.inc.php
• grep -rl "actions_addupdatedelete.inc.php" /path/to/dolibarr/

Additionally, monitoring HTTP requests for suspicious payloads targeting the `perms` attribute of extrafields may help detect exploitation attempts.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and version 24.0.0-alpha. It allows a remote attacker to execute arbitrary code by exploiting the file htdocs/core/actions_addupdatedelete.inc.php.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow a remote attacker to execute arbitrary code on the affected system. This could lead to unauthorized control over the system, data theft, data manipulation, or disruption of services.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include removing or disabling the use of the `dol_eval()` function in the vulnerable code path, specifically in `actions_addupdatedelete.inc.php`.

If possible, upgrade Dolibarr ERP/CRM to a version where this vulnerability is patched or apply a patch that replaces the dynamic evaluation with a safer server-side evaluation mechanism against a fixed grammar.

Restrict administrative access to trusted users only, as exploitation requires administrative privileges.

Monitor and block suspicious HTTP requests that attempt to inject code via the `perms` attribute of extrafields.

Useful 0 Not Useful 0