Dolibarr ERP/CRM 10.0.1 allows attackers to access sensitive database data

Summary

Dolibarr ERP/CRM version 10.0.1 has a security issue that lets attackers who have an account on the system extract sensitive information from the database. This is a serious risk because it could allow unauthorized access to confidential data. To stay secure, update to a fixed version of Dolibarr ERP/CRM as soon as possible.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
dolibarr	dolibarr_erp\/crm	10.0.1	–

Original title

Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through POST parameters. Attackers ca...

Original description

Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through POST parameters. Attackers can inject malicious SQL through parameters like actioncode, demand_reason_id, and availability_id in card.php endpoints to extract sensitive database information using boolean-based blind, error-based, and time-based blind techniques.

nvd CVSS3.1 7.5

nvd CVSS4.0 7.1

Vulnerability type

CWE-89 SQL Injection

https://www.exploit-db.com/exploits/47370 Exploit VDB Entry
https://www.vulncheck.com/advisories/dolibarr-erpcrm-sql-injection-via-cardphp Broken Link