CVE-2025-67486

Katalog CVE

CVSS 7.2 · High EPSS 0,88%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada dolibarr erp/crm. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionality. User-controlled input from the "computed value" field is passed to PHP's `eval()` function without adequate sanitization, allowing authenticated administrators to execute arbitrary PHP code on the server. As of time of publication, no patched versions are available.

Rincian

Terbit di NVD

8 Mei 2026

Terakhir diubah

12 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

0,88% peluang dieksploitasi; lebih tinggi dari 58,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Dolibarr/dolibarr/blob/22.0.2/htdocs/core/lib/functions.lib.php patch
• https://medium.com/@abduxalilovjavohir/dolibarr-erp-authenticated-remote-code-execution-via-eval-injection-in-... exploit · advisory pihak ketiga