Server side template injection In dolibarr/dolibarr
Description
Dolibarr authenticated Remote Code Execution Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to admin/tools/dolibarr_export.php.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 packagist | 12.0.4 |
Aliases
1. 2. 3. 4.
References
1. 2. 3. 4.