CyberRota Analysis
AI-GeneratedDolibarr versions prior to 24.0.0 are vulnerable due to a broken object-level authorization flaw in the REST API, allowing authenticated users with third-party creation rights to manipulate bank account details for any company. This vulnerability enables attackers to inject malicious IBANs, potentially redirecting outgoing payments to their own accounts. Organizations using Dolibarr should prioritize patching this vulnerability to safeguard against unauthorized financial transactions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access to that company. Attackers can inject attacker-controlled IBANs as creditor accounts, which are then written into regenerated SEPA credit-transfer files, redirecting outgoing payments to attacker-controlled accounts.