Threats tagged 'ghsa-3p5c-r87q-62gc'

Dolibarr ERP CRM versions prior to 24.0.0 contain an OS command injection vulnerability in the htdocs/admin/tools/export.php file. This flaw allows authenticated administrators to bypass the restrict_os_commands allowlist by submitting a specially crafted mysqldump value that chains commands using & characters. Exploitation enables execution of arbitrary operating system commands with the privileges of the web server user.