Dolibarr ERP CRM version 7.0.3 contains a vulnerability that allows an attacker to execute arbitrary PHP code without authentication. The flaw is triggered by sending a specially crafted POST request to the install/step1.php script with malicious content in the db_name parameter. The injected PHP is later executed when the attacker accesses the check.php endpoint with a cmd parameter that triggers the evaluation of the injected code. This enables the attacker to run any system command on the host, compromising confidentiality, integrity, and availability of the entire server.

The affected vendor is Dolibarr, specifically the Dolibarr ERP CRM product. Only the 7.0.3 release carries the flaw. No other versions or product lines are known to be impacted according to the available data.

The reported CVSS score of 9.3 indicates critical severity. No EPSS score is available, but the vulnerability is remote, unauthenticated, and exploitable via a simple HTTP request, implying a high likelihood of exploitation. The vulnerability has not been listed in the CISA KEV catalog, yet the absence of a KEV listing does not reduce the risk. Attackers can gain full control of the affected system by abusing this path.