Dolibarr: Claim: Seller offers zero-day RCE…

HighVulnerabilityDisclosedFix unconfirmed

In 30 seconds

Alleged

The latest report says a new forum account is offering an alleged zero-day exploit for Dolibarr 24.0.2, claiming unauthenticated remote code execution. The offer remains unverified: no CVE, affected endpoint or public proof of concept has been provided.

What happened

Alleged

An actor identified as "weykofa" was reported to be soliciting offers for the alleged exploit, payable in Bitcoin or Monero. The seller reportedly promises to share a demonstration video privately after prospective buyers make contact.

Why it matters

Inferred

If the advertised capability is genuine, an attacker could potentially run code on an exposed Dolibarr 24.0.2 system without first logging in. DailyDarkWeb notes that such systems may contain customer, invoice and human-resources data, but the evidence does not show that any installation has been compromised.

What to do

Observed

DailyDarkWeb advises administrators to keep Dolibarr login and administration pages away from the open internet and monitor for patches. Given the lack of technical details, these are precautionary measures rather than mitigations for a confirmed vulnerability.

Confirmed and still uncertain

Observed

The known facts are limited to the public reports and the terms attributed to the seller. It remains unknown whether the exploit works, which endpoint or component it targets, whether versions other than 24.0.2 are affected, and whether the privately advertised video demonstrates a real vulnerability.

What people are saying

Observed

DarkWebInformer describes the offer as an unverified claim. DailyDarkWeb reaches the same conclusion and adds that the seller account is new, a detail that further limits confidence in the advertisement.

Evolution

Observed

The earlier report identified the alleged seller, target version, payment methods and claimed demonstration video. A later report added that the supposed proof would be shared only after contact and emphasized the absence of a CVE, affected endpoint or public proof of concept.

Reach

Observed

2 independent groups, 3 updates, and 36 engagements.

Technical detail

Alleged

The advertisement is described as "pre-auth RCE," meaning remote code execution allegedly possible before authentication. No request format, vulnerable endpoint, payload, execution path or reproducible test accompanies the reports, preventing independent technical validation.

Sources and evidence

Observed

The evidence consists of two X posts summarizing an alleged dark-web forum advertisement. Both label the claim unverified, and neither supplies a public proof of concept or independent confirmation that the advertised exploit works.