CVE-2023-30253: OS Command Injection
First published: Mon May 29 2023(Updated: )
Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/dolibarr/dolibarr | <17.0.1 | 17.0.1 |
| Dolibarr Dolibarr Erp\/crm | <17.0.1 | |
| <17.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.swascan.com/security-advisory-dolibarr-17-0-0/
- https://github.com/Dolibarr/dolibarr
- https://www.swascan.com/blog/
- https://nvd.nist.gov/vuln/detail/CVE-2023-30253
- https://github.com/advisories/GHSA-9wqr-5jp4-mjmh (Advisory)
- https://www.swascan.com/blog
- https://www.swascan.com/security-advisory-dolibarr-17-0-0
Frequently Asked Questions
What is CVE-2023-30253?
CVE-2023-30253 is a vulnerability in Dolibarr before version 17.0.1 that allows remote code execution by an authenticated user via an uppercase manipulation.
How does Dolibarr before 17.0.1 allow remote code execution?
Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation, specifically by using <?PHP instead of <?php in injected data.
What is the severity of CVE-2023-30253?
CVE-2023-30253 has a severity rating of 8.8 (high).
What is the recommended remedy for CVE-2023-30253?
The recommended remedy for CVE-2023-30253 is to upgrade to Dolibarr version 17.0.1 or later.
Where can I find more information about CVE-2023-30253?
You can find more information about CVE-2023-30253 on the following links: [link1], [link2], [link3].
- collector/nvd-latest
- collector/github-advisory
- alias/GHSA-9wqr-5jp4-mjmh
- alias/CVE-2023-30253
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/references
- agent/weakness
- agent/severity
- agent/event
- agent/description
- agent/first-publish-date
- agent/trending
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/tags
- collector/github-advisory-latest
- source/GitHub
- collector/nvd-cve
- package-manager/composer
- vendor/dolibarr
- canonical/dolibarr dolibarr erp\/crm