GHSA-42qm-c3cf-9wv2
Code injection in dolibarr/dolibarr
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | dolibarr/dolibarr | < 15.0.1 | 15.0.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Improper php function sanitization, lead to an ability to inject arbitrary PHP code and run arbitrary commands on file system. In the function "dol_eval" in file "dolibarr/htdocs/core/lib/functions.lib.php" dangerous PHP functions are sanitized using "str_replace" and can be bypassed using following code in $s parameter
References
External links from the advisory. They lead to third-party sites.