CVE-2024-37821

Vulnerability

An arbitrary file upload vulnerability exists in the Upload Template function of Dolibarr ERP CRM versions up to v19.0.1. The application fails to properly validate uploaded files, allowing an attacker to upload a crafted .SQL file, which can contain malicious SQL statements. This vulnerability is classified as CWE-89: SQL Injection [4].

Exploitation

To exploit this vulnerability, an attacker must have the ability to upload a website template. By uploading a specially crafted .SQL file, the attacker can inject SQL statements that are executed when the template is processed by the application. The attack vector is remote, with high privileges required (PR:H), and user interaction is required (UI:R) [4].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the underlying system, potentially leading to privilege escalation and full compromise of the application. The CVSS base score is 8.4 (High), indicating significant impact on confidentiality, integrity, and availability [4].

Mitigation

The vulnerability has been addressed in Dolibarr version 19.0.2. Users are strongly advised to upgrade to this version or later. As of the publication date, no workarounds have been documented [1][4].