CVE-2017-14238: Dolibarr SQL Injection Vulnerability in admin/menus/edit.php
Summary
CVE-2017-14238: Dolibarr SQL injection vulnerability in admin/menus/edit.php. Affects dolibarr/dolibarr versions < 6.0.1. Fixed in 6.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr ERP/CRM is an open-source software package that provides enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is widely used by businesses to manage various aspects of their operations, including inventory, sales, accounting, and customer interactions. The vulnerability in question affects Dolibarr version 6.0.0.
Vulnerability Detail
The vulnerability identified as CVE-2017-14238 is a SQL injection vulnerability that exists in the 'edit.php' file located in the 'admin/menus' directory of Dolibarr. This vulnerability allows remote attackers to execute arbitrary SQL commands by exploiting the 'menuId' parameter. By injecting malicious SQL code, an attacker can manipulate the database and potentially gain unauthorized access to sensitive information or modify data within the system.
How To Fix
Minimum fixed version
6.0.1
This is the first release that contains the fix.
composer require dolibarr/dolibarr:6.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can apply input validation and sanitization measures to the affected parameter ('menuId') in the 'edit.php' file. By implementing proper input filtering and parameter binding techniques, the risk of SQL injection can be mitigated. Here is an example of how to sanitize the 'menuId' parameter using PHP:
$menuId = filter_var($_GET['menuId'], FILTER_SANITIZE_NUMBER_INT);
Conclusion
The Dolibarr SQL injection vulnerability (CVE-2017-14238) poses a significant risk to the security and integrity of Dolibarr ERP/CRM installations running version 6.0.0. It is crucial for users to upgrade to version 6.0.1 or later to ensure the vulnerability is patched and their systems are secure. Implementing proper input validation and sanitization techniques can also provide temporary mitigation until the upgrade is performed. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr ERP/CRM is an open-source software package that provides enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is widely used by businesses to manage various aspects of their operations, including inventory, sales, accounting, and customer interactions.
A SQL injection vulnerability is a security flaw that allows an attacker to manipulate a database by injecting malicious SQL code. By exploiting this vulnerability, an attacker can execute arbitrary SQL commands and potentially gain unauthorized access to sensitive information or modify data within the system.
The Dolibarr SQL injection vulnerability (CVE-2017-14238) allows remote attackers to execute arbitrary SQL commands by exploiting the 'menuId' parameter in the 'edit.php' file. This can lead to unauthorized access to sensitive information, data manipulation, or even a complete compromise of the system.
To fix the Dolibarr SQL injection vulnerability, it is recommended to upgrade to Dolibarr version 6.0.1 or later. This release includes security patches that address the vulnerability by implementing proper input validation and sanitization techniques.
As a temporary workaround, users can apply input validation and sanitization measures to the 'menuId' parameter in the 'edit.php' file. By implementing proper input filtering and parameter binding techniques, the risk of SQL injection can be mitigated.
References
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.