CVE-2018-25357

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0690%

EPSS Percentile42.33th

Published2026年5月23日

Last Modified2026年5月27日

Vulnerability Description

Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.

Affected Platforms (CPE)

📦

Dolibarr

Dolibarr Erp\/crm

<= 7.0.3

References & Advisories

🔗 https://dolibarr.org

🔗 https://github.com/Dolibarr/dolibarr

🔗 https://www.exploit-db.com/exploits/44964

🔗 https://www.vulncheck.com/advisories/dolibarr-erp-crm-remote-code-evaluation-via-install-step1-php

Vulnerability Description

Affected Platforms (CPE)

Dolibarr Erp\/crm

References & Advisories

相关漏洞威胁