CVE-2018-13449: Dolibarr SQL injection vulnerability in product/card.php
Summary
CVE-2018-13449: Dolibarr SQL injection vulnerability in product/card.php. Affects dolibarr/dolibarr versions >= 7.0.3, < 7.0.4. Fixed in 7.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr ERP/CRM is an open-source software package that provides comprehensive business management functionalities. It is widely used for managing various aspects of an organization, including sales, inventory, accounting, and customer relationship management. Dolibarr version 7.0.3 is affected by a SQL injection vulnerability in the product/card.php file. This vulnerability allows remote attackers to execute arbitrary SQL commands by exploiting the statut_buy parameter.
Vulnerability Detail
The SQL injection vulnerability in Dolibarr ERP/CRM version 7.0.3 allows attackers to manipulate the statut_buy parameter to inject malicious SQL commands. This can lead to unauthorized access, data manipulation, or even complete compromise of the application and underlying database. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
7.0.4
This is the first release that contains the fix.
composer require dolibarr/dolibarr:7.0.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by validating and sanitizing user input before using it in SQL queries. This can help prevent the injection of malicious SQL commands. Here is an example of how to sanitize user input in PHP:
$statut_buy = mysqli_real_escape_string($conn, $_GET['statut_buy']);
Conclusion
The SQL injection vulnerability in Dolibarr ERP/CRM version 7.0.3 poses a significant risk to the security and integrity of the application and its underlying database. It is crucial to upgrade to version 7.0.4 or later to mitigate this vulnerability. In the meantime, implementing input validation and sanitization can provide a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr ERP/CRM is an open-source software package that provides comprehensive business management functionalities, including sales, inventory, accounting, and customer relationship management.
A SQL injection vulnerability allows attackers to manipulate input parameters to inject malicious SQL commands into an application's database queries. This can lead to unauthorized access, data manipulation, or even complete compromise of the application and underlying database.
The SQL injection vulnerability in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands. This can lead to unauthorized access, data manipulation, or even complete compromise of the application and underlying database.
To fix this vulnerability, it is recommended to upgrade to Dolibarr version 7.0.4 or later. The upgrade includes patches and security enhancements that address the SQL injection vulnerability.
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by validating and sanitizing user input before using it in SQL queries.
References
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
