Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter

Summary

Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.

Remediation

1. Inventory every Dolibarr dolibarr deployment, including staging.
2. Upgrade Dolibarr dolibarr to 24.0.0.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/Dolibarr/dolibarr/commit/e4c593e0f9f109dd708be0f1d62a51712d36823a
• Advisoryhttps://www.vulncheck.com/advisories/dolibarr-erp-crm-before-24.0.0-os-command-injection-via-mysqldump-parameter
• Referencehttps://github.com/Dolibarr/dolibarr
• Referencehttps://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/admin/tools/export.php#L129-L154
• Referencehttps://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/core/class/utils.class.php#L322-L327