CVE-2017-17897: Dolibarr ERP/CRM SQL Injection Vulnerability in comm/multiprix.php
Summary
CVE-2017-17897: Dolibarr SQL injection vulnerability in comm/multiprix.php. Affects dolibarr/dolibarr versions < 6.0.5. Fixed in 6.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr ERP/CRM is an open-source software package designed for managing business processes, including customer relationship management (CRM) and enterprise resource planning (ERP). It provides a comprehensive set of features for businesses to streamline their operations and improve efficiency. However, a vulnerability has been discovered in the comm/multiprix.php file of Dolibarr version 6.0.4, which allows remote attackers to execute arbitrary SQL commands by exploiting the 'id' parameter.
Vulnerability Detail
The SQL injection vulnerability in Dolibarr ERP/CRM version 6.0.4 arises from inadequate input validation in the comm/multiprix.php file. By manipulating the 'id' parameter, remote attackers can inject malicious SQL commands, potentially leading to unauthorized access, data manipulation, or even complete compromise of the database. This vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected system.
How To Fix
Minimum fixed version
6.0.5
This is the first release that contains the fix.
composer require dolibarr/dolibarr:6.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The SQL injection vulnerability in Dolibarr ERP/CRM version 6.0.4 can be exploited by remote attackers to execute arbitrary SQL commands. To mitigate this risk, it is essential to upgrade to version 6.0.5 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr ERP/CRM is an open-source software package that provides businesses with tools for managing customer relationships, enterprise resource planning, and other business processes.
SQL injection is a type of vulnerability that allows attackers to manipulate SQL queries by injecting malicious code. In this case, the SQL injection vulnerability in Dolibarr ERP/CRM version 6.0.4 enables remote attackers to execute arbitrary SQL commands.
Exploiting this vulnerability can lead to unauthorized access, data manipulation, or complete compromise of the database. It poses a significant risk to the confidentiality, integrity, and availability of the affected system.
To fix this vulnerability, it is recommended to upgrade Dolibarr ERP/CRM to version 6.0.5 or later. The updated version includes patches and fixes that address the SQL injection vulnerability.
Currently, there is no known workaround for this vulnerability. It is crucial to upgrade to the latest version of Dolibarr ERP/CRM to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
