CVE-2024-40137

What it actually does

Authenticated administrator can supply a malicious Computed field value under Users Module Setup that results in arbitrary code execution on the server.

Why it matters to the business

An attacker who already holds administrative access can run commands on the server hosting the ERP system, risking data theft, service disruption, or further network compromise; low EPSS and no KEV listing indicate limited observed exploitation to date.

How an attack unfolds

An attacker with administrative credentials accesses the Users Module Setup page, crafts a payload inside the Computed field parameter, and triggers processing that executes the supplied code on the underlying PHP runtime.

How to fix it

Upgrade Dolibarr to version 19.0.2-php8.2 or later; the listed Chromium packages on Debian 12 should be updated to 127.0.6533.88-1~deb12u1 where applicable in mixed environments.

How to confirm the fix worked

Confirm the installed Dolibarr version is at least 19.0.2-php8.2 and that the Computed field no longer accepts or processes unsanitized input that can lead to code execution.

Typical attack path

1. Obtain administrative account on Dolibarr instance
2. Navigate to Users Module Setup
3. Modify the Computed field parameter with attacker-controlled input
4. Submit the change to trigger server-side code execution

How to detect it

Inspect web server and application logs for unusual submissions to the Users Module Setup endpoint containing code-like strings in the Computed field; correlate with successful PHP process spawns or unexpected file writes initiated by the web server user.

What your security team should do

• Apply the 19.0.2-php8.2 update immediately on all internet-facing instances
• Review administrative access controls and enforce least privilege for ERP users
• Monitor EPSS score and threat intelligence feeds for any future increase in exploitation activity