CVE-2024-5314: Dolibarr vulnerable to SQL Injection
Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in /dolibarr/admin/dict.php.
Published May 24, 2024
Affected packages
dolibarr/dolibarr
- Ecosystem
- Composer (PHP)
- Affected
- <= 9.0.1
- Fixed in
- No patched version yet
- Check
composer show dolibarr/dolibarr
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in /dolibarr/admin/dict.php.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology