CVE-2018-10092 Dolibarr arbitrary commands execution
Remote attackers can execute arbitrary commands via the admin panel's antivirus configuration in Dolibarr.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-10092?
CVE-2018-10092 is a high-severity command injection vulnerability in n/a, published on 22 May 2018. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads.
Weakness: CWE-862
Which versions are affected by CVE-2018-10092?
2 open source packages ship an affected version, including dolibarr/dolibarr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dolibarr/dolibarr Packagist | All versions | 7.0.2 |
dolibarr/dolibarr Packagist | All versions | 7.0.2 |
Products include Dolibarr Dolibarr.
How do I fix CVE-2018-10092?
Upgrade dolibarr/dolibarr to 7.0.2 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-10092 being exploited?
There is no known exploitation of CVE-2018-10092 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2019-19212 Dolibarr Cross-site Scripting via the qty parameter in product/fournisseurs.php
- CVE-2018-16809 Dolibarr SQL injection via the integer parameters qty and value_unit
- CVE-2018-10094 Dolibarr SQL injection vulnerability
- CVE-2018-9019 Dolibarr SQL Injection vulnerability
- CVE-2017-14238 Dolibarr SQL injection vulnerability in admin/menus/edit.php
Sources
Also known as GHSA-6j62-m2vv-wc3m, UBUNTU-CVE-2018-10092.