CVE-2023-30253: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

May 29, 2023 (updated June 5, 2023)

Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.

References

github.com/advisories/GHSA-9wqr-5jp4-mjmh
nvd.nist.gov/vuln/detail/CVE-2023-30253
www.swascan.com/security-advisory-dolibarr-17-0-0/

Detect and mitigate CVE-2023-30253 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →