cve-2023-30253

CVE-2023-30253 설명 Dolibarr 17.0.1 이전 버전에서는 인증된 사용자가 대문자 조작을 통해 원격 코드 실행이 가능합니다: 주입된 데이터에 ?php 대신 ?PHP를 사용합니다. 문서 CVE-2023-30253 GitHub 권고: GHSA-9wqr-5jp4-mjmh 설정 git clone https://github.com/Rubikcuv5/cve-2023-30253.git pip3 install -r requirements.txt python3 CVE-2023-30253.py -h 사용법 usage:...

CVE-2023-30253

CVE-2023-30253 Dolibarr 17.0.0 PHPコードインジェクションエクスプロイト...

CVE-2023-30253-Exploit

CVE-2023-30253 エクスプロイト Dolibarr は大文字操作によるリモートコード実行の脆弱性があります 影響を受けるバージョン 17.0.1 使用方法: pip3 install -r requirements.txt python3 CVE-2023-30253.py...

VulnCheck KEV: CVE-2026-89013

Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...

Exploit for CVE-2026-89013

CVE-2026-89013 — Dolibarr hashp=shared Authorization Bypass E...

Exploit for CVE-2026-89012

CVE-2026-89012 — Dolibarr SQL Filter Denylist Bypass Exploit...

Improper Handling of Case Sensitivity

Overview dolibarr/dolibarr is a modern and easy to use web software to manage your business. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the sqlfilters parameter. An attacker can recover protected database fields by supplying uppercase variants of...

CVE-2026-89013

Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...

CVE-2026-89012

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the...

CVE-2026-89013

Dolibarr 23.0.4 through 24.0.0 contains an authorization bypass in htdocs/document.php and htdocs/viewimage.php that allows unauthenticated attackers to read arbitrary files within the application's managed directories. The root cause is a regression (commit 5028dae981e, shipped in 23.0.4): suppl...

EUVD-2026-76144

Dolibarr 23.0.4 before 24.0.1 ontains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...

CVE-2026-89013 Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php

Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...

CVE-2026-89013 Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php

Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...

CVE-2026-89013 Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php

Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...

CVE-2026-89012 Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the...

EUVD-2026-76141

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the...

CVE-2026-89012 Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the...

CVE-2026-89012

Dolibarr 24.0.0 (before 24.0.1 ) is affected by a case-sensitive denylist bypass in the sqlfilters API query parameter. The root cause is a mismatch between the case-sensitive denylist check in the core library and the case-insensitive database column resolution , allowing authenticated attackers...

CVE-2026-89012 Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the...

CVE-2026-89013: Incorrect Authorization

Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...