What is CVE-2012-10059?

CVE-2012-10059 is a vulnerability in Dolibarr Project Erp/crm, classified under OS Command Injection. Published 2025-08-13.

Is CVE-2012-10059 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Dolibarr Project Erp/crm

CVE-2012-10059

Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sanitize the sql_compat parameter, allowing authenticated users to inject arbitrary system commands, resulting in remote code execution on the server.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.031 (86.4th percentile) — read the EPSS interpretation.

Affected products

Dolibarr Project Erp/crm — versions 0

Weakness classification (CWE)

CWE-78 — OS Command Injection

Public proof-of-concept exploits

rapid7/metasploit-framework

References

disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (technical-description, exploit)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2012-10059?: CVE-2012-10059 is a vulnerability in Dolibarr Project Erp/crm, classified under OS Command Injection. Published 2025-08-13.
Is CVE-2012-10059 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.