CVE-2017-17900: Dolibarr SQL Injection Vulnerability in fourn/index.php
Summary
CVE-2017-17900: Dolibarr SQL injection vulnerability in fourn/index.php. Affects dolibarr/dolibarr versions < 6.0.5. Fixed in 6.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr ERP/CRM is an open-source software package that provides enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is widely used for managing various business processes, including sales, inventory, accounting, and more. Dolibarr version 6.0.4 is affected by a SQL injection vulnerability in the fourn/index.php file. This vulnerability allows remote attackers to execute arbitrary SQL commands by exploiting the socid parameter.
Vulnerability Detail
The SQL injection vulnerability in Dolibarr ERP/CRM version 6.0.4 arises from inadequate input validation in the fourn/index.php file. By manipulating the socid parameter, an attacker can inject malicious SQL commands into the application's database queries. This can lead to unauthorized access, data manipulation, or even complete compromise of the system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
6.0.5
This is the first release that contains the fix.
composer require dolibarr/dolibarr:6.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can apply input validation and sanitization techniques to the socid parameter in the fourn/index.php file. This can be done by implementing parameterized queries or using prepared statements to prevent SQL injection attacks. Here is an example of using prepared statements in PHP:
<?php
$pdo = new PDO('mysql:host=localhost;dbname=dolibarr', 'username', 'password');
$stmt = $pdo->prepare('SELECT * FROM fourn WHERE socid = :socid');
$stmt->bindParam(':socid', $_GET['socid']);
$stmt->execute();
$result = $stmt->fetchAll();
?>
Conclusion
The SQL injection vulnerability in Dolibarr ERP/CRM version 6.0.4 can be exploited by remote attackers to execute arbitrary SQL commands. It is crucial to upgrade to version 6.0.5 or later to mitigate this vulnerability. Implementing input validation and sanitization techniques is also recommended as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr ERP/CRM is an open-source software package that provides enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is widely used for managing various business processes, including sales, inventory, accounting, and more.
A SQL injection vulnerability is a security flaw that allows an attacker to manipulate SQL queries executed by an application. By injecting malicious SQL code, an attacker can bypass authentication, access unauthorized data, modify or delete data, or even execute arbitrary commands on the underlying database.
The SQL injection vulnerability in Dolibarr version 6.0.4 allows remote attackers to execute arbitrary SQL commands by exploiting the socid parameter in the fourn/index.php file. This can lead to unauthorized access, data manipulation, or even complete compromise of the system.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8. It poses a significant risk to the security and integrity of the affected system.
To fix this vulnerability, it is recommended to upgrade Dolibarr ERP/CRM to version 6.0.5 or later. The developers have addressed this issue by implementing proper input validation and sanitization techniques to prevent SQL injection attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
