CVE-2021-33816

Vulnerability

The website builder module in Dolibarr 13.0.2 contains an incomplete protection mechanism against PHP code injection. The application blocks dangerous functions such as system, exec, and shell_exec, but fails to block backticks (` `), which are syntactically equivalent to shell_exec()`. This allows an authenticated user with access to the website builder to inject arbitrary PHP code. The vulnerability affects Dolibarr version 13.0.2 [1][2][3].

Exploitation

An attacker must be authenticated and have sufficient privileges to use the website builder module. The attacker sends a crafted POST request to /website/index.php containing malicious PHP code enclosed in backticks within the website content. The advisory by Trovent Security provides a full HTTP request example demonstrating the exploitation. The application then executes the backtick-enclosed command as PHP code, leading to remote code execution [3].

Impact

Successful exploitation results in remote code execution (RCE) as the web server user. The attacker can execute arbitrary system commands, potentially leading to full compromise of the Dolibarr instance, data exfiltration, or lateral movement within the network. The CVSS score is 9.1 (Critical) with high impact on confidentiality, integrity, and availability [3].

Mitigation

As of the advisory publication date (June 2021), no official patch was available. Users should upgrade to a version beyond 13.0.2 if a fix has been released. As a workaround, restrict access to the website builder module to trusted users only. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog [3].