Threats affecting pkg:github/Dolibarr ERP/CRM

Frappe CRM versions before 1.89.1 have a missing authorization vulnerability in the get_contact_by_phone_number API. This flaw allows authenticated users with low privileges to query CRM Lead records they should not access by supplying a phone number, bypassing normal permission checks. The vulnerability leads to unauthorized disclosure of sensitive CRM lead data.

Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.

Frappe CRM versions before 1.81.2 have a missing authorization vulnerability that allows authenticated Sales Users to access and manipulate other users' CRM Notification records. This occurs because of absent permission hooks, enabling attackers to read, mark as read, or delete notifications belonging to other users via specific API endpoints.

Frappe CRM versions 1.49.0 through 1.87.0 have a missing authorization vulnerability in the crm.api.doc.get_linked_docs_of_document function. This flaw allows authenticated users to access linked documents without proper permission checks, potentially exposing sensitive information such as call log phone numbers, deal organizations, and mention notification text. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.

Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval().