by Kastro
Paper/Archive/CVE-2022-40871

CVE-2022-40871

mitre — Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection.

EPSS 35%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.4.984 × 2019.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/youncyb/dolibarr-rce