Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, identified as CVE-2018-25357, is a critical remote code execution flaw in Dolibarr ERP CRM's installation process. The analysis of the associated patch, commit 41709f07d0aef384723164877395ed081b44b810, points directly to the htdocs/install/step1.php script as the source of the vulnerability. The script failed to properly sanitize the db_name parameter, which is received from a POST request during the first step of installation. The patch shows that the validation for this parameter, along with others, was changed from a lenient 'alpha' filter to a much stricter 'aZ09' filter within the GETPOST function call. This change is the core of the fix. The vulnerability could be exploited by sending a crafted POST request to install/step1.php with malicious PHP code embedded in the db_name parameter. This code would then be written to the conf/conf.php file, and could be triggered by a subsequent request to install/check.php, leading to arbitrary code execution on the server. The vulnerable code is not within a specific function but in the main execution block of the step1.php script, which is why it is identified as {main}.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dolibarr/dolibarr | composer | >= 7.0.0, <= 7.0.3 | 7.0.4 |
| dolibarr/dolibarr | composer | < 6.0.8 | 6.0.8 |
