CVE-2020-14209

HIGH

Dolibarr Unrestricted Upload of File with Dangerous Type

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-14209 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit.

Description

Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control (e.g., to let .noexe files be executed as PHP code to defeat the .noexe protection mechanism).

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Affected products and versions

1
ProductSourceVersion range

dolibarr/dolibarr

Browse Packagist / dolibarr/dolibarr
GitHub AdvisoryBefore 11.0.5 · Fixed in 11.0.5affected

Proofs of concept

1

Catalogued exploits

ExploitDBDolibarr ERP 11.0.4 - File Upload Restrictions Bypass (Authenticated RCE)ExploitDB exploitby Andrea GonzalezNot analyzed1 file
ExploitDB
PoC details

References

5