CVE-2017-7886: Dolibarr SQL Injection in doli/theme/eldy/style.css.php
Summary
CVE-2017-7886: Dolibarr SQL Injection in doli/theme/eldy/style.css.php via the lang parameter. Affects dolibarr/dolibarr versions 4.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr ERP/CRM is an open-source software package that provides enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is widely used by businesses to manage their operations, including sales, inventory, accounting, and more. The package is available on Packagist and can be installed via Composer. However, a vulnerability has been discovered in Dolibarr ERP/CRM version 4.0.4 that allows for SQL Injection attacks. This vulnerability specifically affects the doli/theme/eldy/style.css.php file, which can be exploited via the lang parameter.
Vulnerability Detail
The SQL Injection vulnerability in Dolibarr ERP/CRM version 4.0.4 allows an attacker to manipulate the lang parameter in the doli/theme/eldy/style.css.php file. By injecting malicious SQL code, an attacker can execute arbitrary SQL queries, potentially gaining unauthorized access to the database and compromising the integrity and confidentiality of the system. This vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable or restrict access to the doli/theme/eldy/style.css.php file. By doing so, the vulnerable code will not be accessible, reducing the risk of exploitation. However, this workaround may impact the functionality or appearance of the application, and it is strongly recommended to apply the official patches as soon as possible.
Conclusion
The SQL Injection vulnerability in Dolibarr ERP/CRM version 4.0.4 poses a significant risk to the integrity and confidentiality of the system. It is crucial for users to upgrade to a patched version and implement proper input validation to prevent SQL Injection attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr ERP/CRM is an open-source software package that provides enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is widely used by businesses to manage their operations, including sales, inventory, accounting, and more.
SQL Injection is a type of vulnerability that allows an attacker to manipulate SQL queries executed by a web application. By injecting malicious SQL code, an attacker can bypass security measures and gain unauthorized access to the database, potentially compromising the system's integrity and confidentiality.
To fix the vulnerability, it is recommended to upgrade Dolibarr ERP/CRM to a version that includes the necessary security patches. Additionally, developers should sanitize and validate user input to prevent SQL Injection attacks.
The SQL Injection vulnerability in Dolibarr ERP/CRM can allow an attacker to execute arbitrary SQL queries, potentially gaining unauthorized access to the database. This can lead to data theft, data manipulation, unauthorized access to sensitive information, and other malicious activities.
As a temporary workaround, users can disable or restrict access to the doli/theme/eldy/style.css.php file. However, it is strongly recommended to apply the official patches as soon as possible to fully mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
