CVE-2018-25357: Dolibarr ERP/CRM RCE Vulnerability

CVE-2018-25357 Overview

CVE-2018-25357 is a remote code execution vulnerability in Dolibarr ERP/CRM version 7.0.3. The flaw resides in the installation workflow, specifically in install/step1.php, which fails to sanitize the db_name POST parameter before writing it to a PHP configuration file. Unauthenticated attackers can inject arbitrary PHP code through this parameter and then trigger execution by issuing a GET request to check.php with a cmd parameter. The vulnerability is classified under [CWE-94] Improper Control of Generation of Code (Code Injection) and carries a CVSS v4.0 score of 9.3.

Critical Impact
Unauthenticated remote attackers can execute arbitrary operating system commands on affected Dolibarr ERP/CRM 7.0.3 servers, leading to complete host compromise.

Affected Products

Dolibarr ERP/CRM 7.0.3
Installations exposing the install/ directory after setup
Self-hosted Dolibarr deployments running the vulnerable PHP code path

Discovery Timeline

2026-05-23 - CVE-2018-25357 published to the National Vulnerability Database (NVD)
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2018-25357

Vulnerability Analysis

Dolibarr ERP/CRM 7.0.3 ships with an interactive installer that accepts database configuration values through a POST request to install/step1.php. The installer writes user-supplied values, including db_name, directly into a generated PHP configuration file without input validation or escaping. Because the configuration file is later included by other scripts, any PHP syntax injected into db_name is parsed and executed by the interpreter.

The second-stage endpoint, check.php, reads a cmd GET parameter and passes it to a command execution sink that the attacker planted during step one. The combination produces a reliable unauthenticated remote code execution chain that requires no user interaction.

Root Cause

The root cause is unsanitized input flowing into generated PHP source. The installer treats db_name as a trusted string and concatenates it into a file that is later evaluated by the PHP interpreter. No allowlist, type check, or escaping is applied, so attacker-controlled PHP statements become part of the application's executable code.

Attack Vector

Exploitation proceeds in two HTTP requests. First, the attacker sends a POST request to install/step1.php containing a db_name value that closes the expected string context and appends PHP code implementing a command dispatcher tied to the cmd GET parameter. Second, the attacker requests check.php?cmd=<command> to invoke the planted dispatcher and run arbitrary operating system commands under the privileges of the web server. The full chain is reproducible against any Dolibarr 7.0.3 instance whose install/ directory remains web-accessible. Technical details are documented in the Exploit-DB entry #44964 and the VulnCheck advisory.

Detection Methods for CVE-2018-25357

Indicators of Compromise

POST requests to install/step1.php containing PHP tokens such as <?php, system(, passthru(, or $_GET[ inside the db_name parameter
GET requests to check.php carrying a cmd parameter, especially from unauthenticated sources
Unexpected modifications to Dolibarr configuration files under the htdocs/conf/ directory after initial setup
Web server processes spawning shell utilities (sh, bash, cmd.exe, powershell.exe) shortly after access to install/ URLs

Detection Strategies

Inspect web server access logs for any post-installation traffic to install/step1.php and check.php
Alert on HTTP request bodies that contain PHP delimiters within form fields submitted to the Dolibarr installer
Correlate process creation events on the web host with preceding HTTP requests to Dolibarr installation endpoints

Monitoring Recommendations

Enable a web application firewall (WAF) rule that blocks PHP tags and dangerous function names in installer form parameters
Continuously verify that the install/ directory is removed or access-restricted after Dolibarr is provisioned
Forward web server, PHP-FPM, and host process telemetry to a centralized analytics platform for cross-source correlation

How to Mitigate CVE-2018-25357

Immediate Actions Required

Upgrade Dolibarr ERP/CRM to a supported version beyond 7.0.3 that addresses the installer code injection flaw
Remove or restrict network access to the install/ directory on all production deployments
Audit Dolibarr configuration files for unexpected PHP code introduced through the db_name field
Rotate database credentials and any secrets stored on hosts that ran the vulnerable installer while exposed

Patch Information

No vendor advisory URL is referenced in the NVD entry for CVE-2018-25357. Administrators should obtain the latest release from the Dolibarr official website or the GitHub Dolibarr repository and apply it to all instances running 7.0.3.

Workarounds

Delete the htdocs/install/ directory immediately after completing initial Dolibarr setup
Place the application behind authentication or IP allowlisting at the reverse proxy layer until patched
Deploy WAF signatures that reject installer requests containing PHP code in form parameters
Run the PHP process under a least-privileged account to limit the impact of successful command execution

bash

# Configuration example: restrict access to the Dolibarr install directory in Apache
<Directory "/var/www/dolibarr/htdocs/install">
    Require ip 127.0.0.1
    Require all denied
</Directory>

# Or remove the directory entirely once setup is complete
rm -rf /var/www/dolibarr/htdocs/install