CWE Code: 94
Vulnerability Type: privilege_escalation
CVSS Score: 8.5
CWE Name:  Improper Control of Generation of Code ('Code Injection')
Summary: dolibarr erp/crm 9.0.1 provides a module named website that provides for creation of public websites with a wysiwyg editor. it was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. an attacker has to check a setting on the same page, which specifies the inclusion of dynamic content. thus, a lower privileged user of the application can execute code under the context and permissions of the underlying web server.
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2019-07-29
Last Modified Date: 2019-08-05