CVE-2023-30253: Dolibarr vulnerable to remote code execution via uppercase manipulation

May 29, 2023 (updated January 14, 2025)

Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.

References

github.com/Dolibarr/dolibarr
github.com/advisories/GHSA-9wqr-5jp4-mjmh
nvd.nist.gov/vuln/detail/CVE-2023-30253
www.swascan.com/blog
www.swascan.com/security-advisory-dolibarr-17-0-0

Code Behaviors & Features

Detect and mitigate CVE-2023-30253 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →