CVE-2023-30253-exploit

CVE-2023-30253 — Dolibarr ERP/CRM 17.0.0 リモートコード実行 Dolibarr ERP/CRM v17.0.0 向けの PHP コードインジェクションエクスプロイトです。Website/CMS モジュールを介して、www-data ユーザーとして リバースシェル を取得できます。 ⚠️ 教育目的および許可を得た監査にのみ使用してください。 📑 目次 CVE-2023-30253 とは？ 脆弱性の仕組み 影響 このエクスプロイトの機能 要件 インストール 使用方法 実践例 エクスプロイトの詳細解説 軽減策 参考情報 🔍 CVE-2023-30253 と...

CVE-2023-27742

CVE-2023-27742 IDURAR ERP/CRM v1 には、コンポーネント /api/login を介した SQL インジェクションの脆弱性が存在することが発見されました。 Description IDURAR ERP/CRM v1 には、コンポーネント /api/login を介した SQL インジェクションの脆弱性が存在することが発見されました。 Vulnerability Type SQL インジェクション Vendor of Product IDURAR ERP/CRM v1 Affected Product Code Base...

Exploit-for-Dolibarr-17.0.0-CVE-2023-30253

Dolibarr example: python3 exploit.py http://example.com login password 127.0.0.1 9001 ---Reverse Shell Exploit for Dolibarr = 17.0.0 CVE-2023-30253--- positional arguments: hostname Target hostname username Username of Dolibarr ERP/CRM password Password of Dolibarr ERP/CRM lhost Listening host fo...

CVE-2026-81031

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

EUVD-2026-66607

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-81031

CVE-2026-81031 affects IDURAR ERP CRM through version 4.1.1 . The vulnerability resides in the password update handler (updatePassword.js), which applies a password change to the identifier in the URL path rather than verifying it matches the authenticated user. Because the route requires only a ...

CVE-2026-81031 IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-81031 IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-81031 IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-81031: Authorization Bypass Through User-Controlled Key

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

PT-2026-82219

Name of the Vulnerable Software and Affected Versions IDURAR ERP CRM affected versions not specified Description An issue exists where the system changes the password of any account specified in a request instead of the account making the request. The update handler in...

CVE-2026-72600

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can...

EUVD-2026-56039

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can...

CVE-2026-72600

Idurar IDURAR ERP CRM 4.1.0 contains a broken access control vulnerability that allows unauthenticated remote attackers to download invoice PDFs containing customer PII via the /download route. The router is mounted without authentication middleware, enabling public access, and an attacker can en...

CVE-2026-72600: Improper Access Control

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can...

PT-2026-70144

Name of the Vulnerable Software and Affected Versions Idurar IDURAR ERP CRM version 4.1.0 Description A broken access control issue allows unauthenticated remote attackers to download invoice PDF files containing customer personally identifiable information PII. This occurs because the '/download...

CVE-2026-11619

A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy Filemanager. The manipulation leads to improper authorization. It is possible to initiate the...

CVE-2026-11619 Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization

A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy Filemanager. The manipulation leads to improper authorization. It is possible to initiate the...

CVE-2026-11619: Improper Authorization

A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy Filemanager. The manipulation leads to improper authorization. It is possible to initiate the...

Linux Distros Unpatched Vulnerability : CVE-2026-37713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the...