PHP Remote File Inclusion Affecting dolibarr/dolibarr package, versions >=0.0.0

dolibarr/dolibarr is a modern and easy to use web software to manage your business.

Affected versions of this package are vulnerable to PHP Remote File Inclusion in the perms process of menu creation and editing, where user-supplied input is evaluated without sufficient filtering of dangerous PHP functions. An attacker can execute arbitrary code and access sensitive files by submitting crafted PHP code as menu permissions, which is then executed on the server. This can be exploited through local or remote file inclusion, and may be further leveraged by uploading a file without a suffix and including it via the menu permissions. This is only exploitable if the attacker has authenticated access to the backend menu management functionality and, for remote file inclusion, if the allow_url_include option is enabled in the PHP configuration.

• Vulnerable Code