CVE-2018-25357

🗓️ 23 May 2026 18:32:14Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 18 Views🌐 WEB

Dolibarr 7.0.3 allows unauthenticated remote code execution via PHP in db_name on install/step1.php, enabling commands through check.php.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2018-25357	23 May 202618:32	–	attackerkb
Circl	CVE-2018-25357	27 May 202618:07	–	circl
CNNVD	Dolibarr ERP CRM 代码注入漏洞	23 May 202600:00	–	cnnvd
Cvelist	CVE-2018-25357 Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php	23 May 202618:32	–	cvelist
EUVD	EUVD-2018-21879	23 May 202618:32	–	euvd
NVD	CVE-2018-25357	23 May 202619:16	–	nvd
OSV	UBUNTU-CVE-2018-25357	23 May 202619:16	–	osv
Positive Technologies	PT-2026-43096	23 May 202600:00	–	ptsecurity
UbuntuCve	CVE-2018-25357	23 May 202619:16	–	ubuntucve
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2018-25357	27 May 202600:00	–	nessus

NVD

Vulners

CNA

Node

dolibarr dolibarr_erp/crmRange≤7.0.3

[
  {
    "vendor": "Dolibarr",
    "product": "Dolibarr ERP CRM",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "versionType": "semver",
        "lessThanOrEqual": "7.0.3"
      }
    ]
  }
]

Source	Link
exploit-db	www.exploit-db.com/exploits/44964
vulncheck	www.vulncheck.com/advisories/dolibarr-erp-crm-remote-code-evaluation-via-install-step1-php
dolibarr	www.dolibarr.org/
github	www.github.com/Dolibarr/dolibarr

Parameter	Position	Path	Description	CWE
db_name	request body	install/step1.php	Unauthenticated remote code execution via PHP injection in db_name parameter during installation step1.php	CWE-94
cmd	query param	check.php	Execute arbitrary commands via cmd GET parameter on check.php after injecting PHP code	CWE-94

27 May 2026 15:56Current

6.7Medium risk

Vulners AI Score6.7

CVSS 49.3

CVSS 3.19.8

EPSS0.01745

SSVC

CWE-94