CVE-2021-33816 Dolibarr remote PHP code execution

What is CVE-2021-33816?

CVE-2021-33816 is a critical code injection vulnerability in Dolibarr Dolibarr Erp\/Crm, published on 10 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.

Weakness: CWE-94

Which versions are affected by CVE-2021-33816?

3 open source packages ship an affected version, including dolibarr/dolibarr and dolibarr. It affects 1 product.

Products include Dolibarr Dolibarr Erp\/Crm.

How do I fix CVE-2021-33816?

Upgrade dolibarr/dolibarr to 14.0.0 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-33816 being exploited?

There is no known exploitation of CVE-2021-33816 in the wild and no public exploit code.

Other vulnerabilities in Dolibarr Dolibarr Erp\/Crm

• CVE-2022-43138 Dolibarr vulnerable to privilege escalation Critical 9.8
• CVE-2022-40871 Dolibarr vulnerable to Eval Injection Critical 9.8
• CVE-2020-7995 Dolibarr Improper Restriction of Excessive Authentication Attempts Critical 9.8
• CVE-2013-2091 SQL injection in dolibarr Critical 9.8
• CVE-2013-2093 Command injection in dolibarr Critical 9.8

All Dolibarr Dolibarr Erp\/Crm vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-dolibarr-2021-33816, GHSA-vxr9-p2xw-m8cf, UBUNTU-CVE-2021-33816.