POC-exploit-for-Dolibarr

针对 Dolibarr example: python3 exploit.py http://example.com login password 127.0.0.1 9001 ---Reverse Shell Exploit for Dolibarr = 17.0.0 CVE-2023-30253--- positional arguments: hostname Target hostname username Username of Dolibarr ERP/CRM password Password of Dolibarr ERP/CRM lhost Listening host...

Dolibarr-17.0.0-Exploit-CVE-2023-30253

Readme.md CVE-2023-30253 CVE-2023-30253 是 Dolibarr 软件中的一个安全漏洞，它允许经过身份验证的用户通过在被注入的数据中使用大写字母操作技巧来执行远程代码。 影响 此漏洞可导致恶意行为者未经授权执行远程代码，对受影响系统的安全性和完整性构成严重威胁。 该漏洞已在 Dolibarr 17.0.1 版本中修复。 参考 https://www.swascan.com/security-advisory-dolibarr-17-0-0/ https://github.com/Dolibarr/dolibarr 概念验证 以下 POC...

CVE-2020-13094

Título: Dolibarr 11.0.3 - Cross-Site Scripting Persistente Autor: Mehmet Kelepce / Gais Cyber Security Fecha: 2020-04-14 Proveedor: https://www.dolibarr.org/ ID de autor en Exploit-DB: 8763 Explotable remotamente: Sí Lenguaje de programación dinámica: PHP Puntuación base CVSSv3: 7.4 AV:N, AC:L,...

CSRF-breach

Security breach project - Cross Site Request Forgery Dolibarr 7.0.0 está afectado por: Cross Site Request Forgery CSRF. El impacto es: permite que HTML malicioso cambie la contraseña del usuario, deshabilite usuarios y deshabilite el cifrado de contraseñas. El componente es: Función de cambio de...

DolibabyPhp

DolibabyPhp 针对 Dolibarr ERP/CRM CVE-2023-30253 的认证 RCE 漏洞利用程序。 安装 你可以使用 pip 从 PyPi 仓库安装该包，或者直接从 GitHub git clone 源码。 root@kitploit: pip install dolibabyphp 用法 root@kitploit: Usage: dolibabyphp OPTIONS TARGETURL USERNAME PASSWORD COMMAND ARGS... This exploit will log into the Dolibarr web server a...

CVE-2023-30253-PoC

CVE-2023-30253 CVE-2023-30253 PoC 描述 这是我对 CVE-2023-30253（Dolibarr 17.0.0 PHP 代码注入）的 PoC，当 CMS 网站插件（核心）被启用时，经过身份验证的攻击者可以通过绕过应用程序限制的 PHP 代码注入获得远程命令执行。 安装 克隆仓库： root@kitploit: git clone https://github.com/g4nkd/CVE-2023-30253-PoC.git cd CVE-2023-30253-PoC pip install -r requirements.txt 使用...

CVE-2023-30253

CVE-2023-30253 Dolibarr 17.0.0 Exploit de Inyección de Código PHP...

Dolibarr ERP CMS `list.php` - SQL Injection

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. id: CVE-2024-5315 info: name: Dolibarr ERP CMS list.php - SQL Injection author: rootxharsh,iamnoooob,pdresearch severity: critical description: | Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0....

Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities

Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. dot dot in the 1 file parameter to document.php or 2 backtopage parameter in a create action to comm/action/fiche.php. id:...

Dolibarr Unauthenticated Contacts Database Theft

An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists. id: CVE-2023-33568 info: name: Dolibarr Unauthenticated Contacts Database Theft...

Dolibarr <=22.0.4 - Local File Inclusion

Dolibarr = 22.0.4 contains a local file inclusion caused by manipulation of the objectdesc parameter and a fail-open logic flaw in restrictedArea in /core/ajax/selectobject.php, letting authenticated users with no specific privileges read arbitrary non-PHP files. id: CVE-2026-34036 info: name:...

CVE-2026-85401

A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The...

CVE-2026-85401 Dolibarr Legacy File Manager config.inc.php access control

A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The...

CVE-2026-85401 Dolibarr Legacy File Manager config.inc.php access control

A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The...

EUVD-2026-70872

A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The...

CVE-2026-85401

CVE-2026-85401 affects Dolibarr (versions up to 21.0.4, 22.0.5, and 23.0.3) in the Legacy File Manager component, specifically in the file htdocs/core/filemanagerdol/connectors/php/config.inc.php. The vulnerability is an improper access control flaw exploitable remotely with low privileges, yield...

CVE-2026-34036

CVE-2026-34036 Proof-of-concept script for CVE-2026-34036 , an authenticated local file inclusion / LFI in Dolibarr. The issue is reachable through core/ajax/selectobject.php. An authenticated user can abuse the objectdesc parameter to make the application read arbitrary local files on the server...

CVE-2026-23500

CVE-2026-23500: Inyección de comandos del sistema operativo RCE a través de la configuración MAINODTASPDF en Dolibarr Información general...

CVE-2023-30253-exploit

CVE-2023-30253 — Dolibarr ERP/CRM 17.0.0 Remote Code Execution Exploit de inyección de código PHP para Dolibarr ERP/CRM v17.0.0 que permite obtener una shell reversa como usuario www-data mediante el módulo Website/CMS. ⚠️ Solo para uso educativo y auditorías con autorización. 📑 Índice ¿Qué es...

Dolibarr <7.0.2 - Cross-Site Scripting

Dolibarr before 7.0.2 is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php. id: CVE-2018-10095 info: name: Dolibarr 7.0.2 - Cross-Site Scripting author: pikpikcu severity: medium...