CVE-2011-4802
Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sortfield, (2) sortorder, and (3) sall parameters to user/index.php and (b)…
Does this matter?
Lower severity and a low EPSS score (5.46%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sortfield, (2) sortorder, and (3) sall parameters to user/index.php and (b) user/group/index.php; the id parameter to (4) info.php, (5) perms.php, (6) param_ihm.php, (7) note.php, and (8) fiche.php in user/; and (9) rowid parameter to admin/boxes.php.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 5.46% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- dolibarr/dolibarr erp\/crm
- Source
- cve@mitre.org
References
- http://osvdb.org/77340Broken Link
- http://osvdb.org/77341Broken Link
- http://osvdb.org/77342Broken Link
- http://osvdb.org/77343Broken Link
- http://osvdb.org/77344Broken Link
- http://osvdb.org/77345Broken Link
- http://osvdb.org/77346Broken Link, Exploit
- http://osvdb.org/77347Broken Link, Exploit
- http://www.securityfocus.com/archive/1/520619/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/50777Exploit, Third Party Advisory, VDB Entry
- https://github.com/Dolibarr/dolibarr/commit/63820ab37537fdff842539425b2bf2881f0d8e91Exploit, Patch
- https://github.com/Dolibarr/dolibarr/commit/762f98ab4137749d0993612b4e3544a4207e78a1Exploit, Patch
- https://github.com/Dolibarr/dolibarr/commit/c539155d6ac2f5b6ea75b87a16f298c0090e535aExploit, Patch
- https://github.com/Dolibarr/dolibarr/commit/d08d28c0cda1f762a47cc205d4363de03df16675Exploit, Patch
- https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_dolibarr.htmlExploit
- http://osvdb.org/77340Broken Link
- http://osvdb.org/77341Broken Link
- http://osvdb.org/77342Broken Link
- http://osvdb.org/77343Broken Link
- http://osvdb.org/77344Broken Link
- http://osvdb.org/77345Broken Link
- http://osvdb.org/77346Broken Link, Exploit
- http://osvdb.org/77347Broken Link, Exploit
- http://www.securityfocus.com/archive/1/520619/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/50777Exploit, Third Party Advisory, VDB Entry
- https://github.com/Dolibarr/dolibarr/commit/63820ab37537fdff842539425b2bf2881f0d8e91Exploit, Patch
- https://github.com/Dolibarr/dolibarr/commit/762f98ab4137749d0993612b4e3544a4207e78a1Exploit, Patch
- https://github.com/Dolibarr/dolibarr/commit/c539155d6ac2f5b6ea75b87a16f298c0090e535aExploit, Patch
- https://github.com/Dolibarr/dolibarr/commit/d08d28c0cda1f762a47cc205d4363de03df16675Exploit, Patch
- https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_dolibarr.htmlExploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.