CVE-2023-4198: 
PHP vulnerability analysis and mitigation

Dolibarr ERP CRM versions up to 17.0.3 contain an Improper Access Control vulnerability (CVE-2023-4198) that allows unauthorized authenticated users to read database tables containing customer data. The vulnerability was discovered in September 2023 and affects the ajaxcompanies.php endpoint (STAR Labs).

The vulnerability exists in the /core/ajax/ajaxcompanies.php endpoint where authorization checks are missing. Any authenticated user can access and list details of all third-party customers stored in the societe database table, regardless of their permission level. The vulnerability has a CVSS 3.1 Base Score of 6.5 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility, low attack complexity, and high impact on confidentiality (STAR Labs).

The vulnerability allows unauthorized access to sensitive customer information stored in the database, including third-party customers' addresses, ZIP codes, and town names. This represents a significant data privacy concern as any authenticated user, regardless of their permission level, can access this confidential information (STAR Labs).

The recommended mitigation is to update Dolibarr ERP CRM to version 18.0.0 or later, where the vulnerable endpoint has been removed. Organizations can also monitor their server access logs for suspicious requests to /core/ajax/ajaxcompanies.php and inspect the newcompany parameter values to detect potential exploitation attempts (STAR Labs).