Vulnerabilities > CVE-2018-10092 - Missing Authorization vulnerability in Dolibarr
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
SINGLE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Packetstorm
data source | https://packetstormsecurity.com/files/download/147923/dolibarr700-exec.txt |
id | PACKETSTORM:147923 |
last seen | 2018-05-31 |
published | 2018-05-27 |
reporter | Kevin Locati |
source | https://packetstormsecurity.com/files/147923/Dolibarr-7.0.0-Admin-Panel-Remote-Code-Execution.html |
title | Dolibarr 7.0.0 Admin Panel Remote Code Execution |
References
- http://www.openwall.com/lists/oss-security/2018/05/21/2
- https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog
- https://github.com/Dolibarr/dolibarr/commit/5d121b2d3ae2a95abebc9dc31e4782cbc61a1f39
- https://sysdream.com/news/lab/2018-05-21-cve-2018-10092-dolibarr-admin-panel-authenticated-remote-code-execution-rce-vulnerability/