CVE-2021-33816: Code Injection
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shellexec are blocked but backticks are not blocked.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-33816.
What is the severity of CVE-2021-33816?
The severity of CVE-2021-33816 is critical with a CVSS score of 9.8.
Which version of Dolibarr is affected by CVE-2021-33816?
Dolibarr version 13.0.2 is affected by CVE-2021-33816.
How does CVE-2021-33816 allow remote PHP code execution?
CVE-2021-33816 allows remote PHP code execution due to an incomplete protection mechanism that blocks system, exec, and shell_exec but not backticks.
Are there any references available for CVE-2021-33816?
Yes, references for CVE-2021-33816 are available at the following URLs: [link1](http://seclists.org/fulldisclosure/2021/Nov/39), [link2](https://trovent.github.io/security-advisories/TRSA-2106-01/TRSA-2106-01.txt), [link3](https://trovent.io/security-advisory-2106-01)