CVE-2019-1010054

HIGH

Dolibarr 7.0.0 - Cross-Site Request Forgery in User Management Functions

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-1010054. PoCs published by chaizeg.

AI-analyzed exploit summary This repository provides a detailed analysis of a CSRF vulnerability in Dolibarr 7.0.0, including steps to reproduce the exploit and a report in French. It describes the impact as allowing malicious HTML to change user passwords, disable users, and disable password encryption.

Description

Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access malitious urls.

Exploits (1)

nomisec WRITEUP 1 stars
by chaizeg · poc
https://github.com/chaizeg/CSRF-breach

This repository provides a detailed analysis of a CSRF vulnerability in Dolibarr 7.0.0, including steps to reproduce the exploit and a report in French. It describes the impact as allowing malicious HTML to change user passwords, disable users, and disable password encryption.

Classification
Writeup 80%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Dolibarr 7.0.0
Auth required
Prerequisites: admin access to malicious URLs · vagrant environment setup
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0056
EPSS Percentile 68.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352
Status published
Products (2)
dolibarr/dolibarr Packagist
dolibarr/dolibarr_erp\/crm 7.0.0
Published Jul 18, 2019
Tracked Since Feb 18, 2026