External risk intelligence

Dolibarr ERP CRM Remote Code Execution via install step1.php.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2018-25357

Dolibarr is an ERP/CRM application commonly deployed as a web-based service accessible over the network. Because it acts as a central business management platform, these instances are frequently exposed to the internet or wide internal networks to facilitate remote access for users, making the web-based installation and configuration endpoints reachable in many common deployment scenarios.

Code Injection

Dolibarr Erp\/crm

7.0.3 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Dolibarr ERP/CRM software that could allow attackers to execute arbitrary code remotely without authentication by injecting malicious code during the installation or configuration process. The primary concern is confirming whether our instance of this software is affected and, if so, understanding the potential exposure.

Attackers can run unauthorized code.
It impacts core business management software.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can initiate an attack by sending a POST request to the installation script with a specially crafted database name. If the application proceeds to a subsequent check endpoint, the attacker can then send a GET request to execute arbitrary commands on the server.

No authentication required.
Inject PHP code via `db_name` parameter.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute arbitrary PHP code on systems running Dolibarr ERP/CRM when its installation or configuration is exposed. This could lead to the compromise of the application's server, potentially affecting business operations and sensitive data handled by the ERP/CRM.

Arbitrary code execution on the server.
Via a POST request to installation scripts.
Compromise of business operations and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Dolibarr ERP/CRM application, often deployed as a web service for user access, presents a critical risk due to its network-accessible installation and configuration endpoints. System owners and infrastructure teams should prioritize identifying all Dolibarr instances, confirming their reachability and business criticality, and then engaging the accountable application or platform owner to plan risk-based remediation.

Application owners must own this issue.
Verify all external-facing instances first.
Plan remediation based on verified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dolibarr ERP CRM?

Dolibarr is a modular business management software suite designed to handle enterprise resource planning and customer relationship management tasks. It serves as a centralized platform for organizations to track sales, inventory, accounting, and various administrative workflows. Because it functions as a web-based service, it is typically hosted on servers that are reachable over a network, allowing employees to access critical business data and tools through their web browsers.

What is the vulnerability in CVE-2018-25357?

This vulnerability is classified as Improper Control of Generation of Code, specifically CWE-94. In plain terms, it allows an unauthenticated user to inject and execute their own PHP commands on the server running the application. By tricking the software into processing malicious input as if it were legitimate code, an attacker can gain the ability to run unauthorized instructions, essentially taking control of the application's underlying server environment.

How is this Dolibarr vulnerability triggered?

An attacker initiates this by sending a specifically crafted POST request to the installation script, injecting PHP code into the database name parameter. It is important to note that this requires the application's installation or configuration endpoints to be active and reachable. Simply having the software installed does not trigger the bug; the attacker must be able to interact with the specific installation and configuration scripts to successfully inject and execute the code.

How do I know if my Dolibarr instance is at risk?

According to Halo Surface Signal, Dolibarr is frequently deployed as a web-facing service to support remote access, which often makes these configuration endpoints accessible over the internet or broad internal networks. If your instance is reachable from a network where unauthorized parties can reach your web server, it is at higher risk. You should determine if your deployment is exposed to these network segments and check if it is running a version affected by this issue.

What steps should I take if I use this software?

First, identify all instances of Dolibarr ERP CRM within your environment, prioritizing those that are internet-facing or accessible to unauthorized users. Once identified, verify which versions are currently in use. Coordinate with the individuals responsible for maintaining these applications to assess the risk and apply the necessary updates or configuration changes to secure the installation endpoints and prevent unauthorized code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.