CVE-2023-38888

Name of the Vulnerable Software and Affected Versions Dolibarr ERP CRM versions 17.0.1 and earlier

Description The issue allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module. This is related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.

Recommendations For versions 17.0.1 and earlier, update to a version later than 17.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the REST API module until a patch is available. Avoid using the analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject functions in the REST API module until the issue is resolved.