high7.5
CVE-2023-4197
Dolibarr Improper Input Validation vulnerability
Impact
Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | dolibarr/dolibarr | < 18.0.2 | 18.0.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dolibarr | Dolibarr Erp\/Crm | through 18.0.1 |