Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the same page, which specifies the inclusion of dynamic content. Thus, a lower privileged user of the application can execute code under the context and permissions of the underlying web server.
2019-07-29T16:15:11.413
2024-11-21T04:20:42.907
Modified
CVSSv3.0: 8.0 (HIGH)
AV:N/AC:M/Au:S/C:C/I:C/A:C
6.8
10.0
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | dolibarr | dolibarr_erp\/crm | 9.0.1 | Yes |