#VU28306 Arbitrary file upload in dolibarr - CVE-2020-13240

Vulnerability identifier: #VU28306

Vulnerability risk: Medium

CVSSv4.0: 7.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2020-13240

CWE-ID: CWE-434

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
dolibarr
Web applications / CRM systems

Vendor: Dolibarr ERP & CRM

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload. A remote authenticated user with "Setup documents directories" permission can rename uploaded files to have insecure file extensions, leading to a malicious file execution on the server.

Mitigation
Install update from vendor's website.

Vulnerable software versions

dolibarr: 6.0.0 - 11.0.4

---

External links
https://www.dubget.com/stored-xss-via-file-upload.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.