CVE-2012-1226 Path traversal in n/a

What is CVE-2012-1226?

CVE-2012-1226 is a high-severity path traversal vulnerability in Dolibarr Dolibarr Erp\/Crm, published on 21 Feb 2012. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the (1) file parameter to document.php or (2) backtopage parameter in a create action to comm/action/fiche.php.

Weakness: CWE-22

Which versions are affected by CVE-2012-1226?

It affects 1 product.

Products include Dolibarr Dolibarr Erp\/Crm.

How do I fix CVE-2012-1226?

No fix has been published for CVE-2012-1226 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2012-1226 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-1226 exists.

Public exploit code: 2 Exploit-DB entries and 1 Nuclei template.

Other vulnerabilities in Dolibarr Dolibarr Erp\/Crm

• CVE-2022-43138 Dolibarr vulnerable to privilege escalation Critical 9.8
• CVE-2022-40871 Dolibarr vulnerable to Eval Injection Critical 9.8
• CVE-2021-33816 Dolibarr remote PHP code execution Critical 9.8
• CVE-2020-7995 Dolibarr Improper Restriction of Excessive Authentication Attempts Critical 9.8
• CVE-2013-2091 SQL injection in dolibarr Critical 9.8

All Dolibarr Dolibarr Erp\/Crm vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-67ww-jmxf-h84x.