CVE-2018-25357: Dolibarr Erp/crm

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.

Affected products

• Dolibarr Dolibarr Erp/crm: up to and including 7.0.3

Published 2026-05-23. Last modified 2026-10-08.