Hello all,
To all integrators, developers (or even self-hosted installation users) who have Dolibarr accessible from the internet, be sure to put/create an install.lock file in your document folder. (Where is this folder ? during installation you chose it, if not look in your conf/conf.php file)
An exploitation, documented on specialized sites, allows admin account creation and then code execution on your server. This exploitation has already been reported on some Dolibarr “badly” installed.
Code execution => the hacker will be able to do what he wants on your server, encrypt it, recover your database, spam, you have your online store or your website on the same server, the same…, in short all that can be done with a server on the Internet
This is not a direct security vulnerability of Dolibarr, because it is a good practice and Dolibarr tell you when you did not do it (on the home page).
If you leave the keys on the door when you are told not to do it…
Thanks to @FHenry that reported today the exploitation of “weak” Dolibarr’s
