Abderrahmane Aksoum

**Name of the Vulnerable Software and Affected Versions** Dolibarr versions prior to 23.0.4 **Description** A weakness in the Legacy File Manager component, specifically within the file `htdocs/core/filemanagerdol/connectors/php/config.inc.php`, allows for improper access controls. This issue can be exploited remotely by executing a specific manipulation. **Recommendations** Upgrade to version 23.0.4. Restrict access to the `htdocs/core/filemanagerdol/connectors/php/config.inc.php` file as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** Dolibarr ERP versions prior to 18.0.11 Dolibarr ERP versions prior to 22.0.6 Dolibarr ERP versions prior to 23.0.4 **Description** An authorization bypass exists in the User Notes Handler component due to improper processing of the `/user/note.php` endpoint. A remote attacker can exploit this by manipulating the `ID` argument to bypass security checks. **Recommendations** Update to version 23.0.4. Update to version 24.0.0. As a temporary mitigation, restrict access to the `/user/note.php` file.

**Name of the Vulnerable Software and Affected Versions** Dolibarr versions prior to 24.0.0 **Description** An improper authorization issue exists in the Account Handler component within the file htdocs/user/card.php. A remote attacker can exploit this by manipulating the `ID` argument, allowing unauthorized access or actions. **Recommendations** Upgrade to version 24.0.0.

**Name of the Vulnerable Software and Affected Versions** Dolibarr versions prior to 23.0.4 **Description** A flaw in the User Cloning component within the file htdocs/user/card.php allows for remote LDAP injection. This occurs through the manipulation of the `ID` argument. LDAP injection is a technique where malicious input is used to interfere with the queries sent to a Lightweight Directory Access Protocol server, potentially allowing unauthorized access or data retrieval. **Recommendations** Apply patch 798e65356ede03c2812ab1a728f23fae34de5592 to resolve the issue. Restrict access to the file htdocs/user/card.php as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** Dolibarr ERP versions prior to 23.0.4 **Description** A remote issue exists in the TakePOS Module within the `fail()` function of the `htdocs/takepos/invoice.php` file. This flaw allows for missing authorization, enabling a remote attacker to bypass security checks. **Recommendations** Apply patch 8992ce8704da947b6abe7b65a6fe59aed736bb81 to resolve the issue. As a temporary mitigation, restrict access to the `fail()` function in the `htdocs/takepos/invoice.php` file.

**Name of the Vulnerable Software and Affected Versions** Dolibarr ERP CRM versions prior to 23.0.3 **Description** An improper authorization issue exists within the Legacy Filemanager component, specifically affecting a function in the file `htdocs/core/filemanagerdol/connectors/php/config.inc.php`. This flaw allows a remote attacker to bypass authorization controls. **Recommendations** Update to version 23.0.3.

**Name of the Vulnerable Software and Affected Versions** Dolibarr ERP CRM versions 23.0.0 through 23.0.2 **Description** An issue exists in an unknown function within the file 'htdocs/user/messaging.php' that allows for remote authorization bypass. This occurs through the manipulation of the `ID` argument. **Recommendations** Upgrade to version 23.0.3.