An authenticated user with limited privileges can execute arbitrary PHP code in Dolibarr ERP & CRM, leading to full system compromise.

This vulnerability occurs because PHP code detection and permission enforcement in the Website module are not applied consistently to all input parameters. An authenticated attacker with restricted privileges, such as those limited to HTML or JavaScript editing, can bypass these restrictions to inject and execute arbitrary PHP code during the website page creation process.

The vulnerability carries a CVSS score of 8.8, reflecting its high severity and potential for total impact on confidentiality, integrity, and availability. Successful exploitation allows an attacker to gain unauthorized control over the server hosting the ERP system, which could lead to the exfiltration of sensitive business data, unauthorized modifications to financial records, or a complete disruption of business operations.

Immediate Action: Since no official patch is currently listed, administrators should immediately restrict access to the Website module to only highly trusted administrative users.

Proactive Monitoring: Security teams should monitor web server logs for suspicious POST requests targeting the website creation endpoint and watch for unexpected PHP file creation or modification events on the filesystem.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect incoming traffic for malicious PHP code patterns and restrict access to the affected administrative functions via IP whitelisting.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the research write-up referenced in the CVE record.

Given the high CVSS score and the ability for authenticated attackers to achieve remote code execution, this vulnerability poses a significant risk to the integrity of the Dolibarr environment. Organizations should treat this as a priority, limiting access to the vulnerable Website module until an official vendor update is released and applied to remediate the underlying code enforcement flaw.