CVE-2018-9019: Dolibarr SQL Injection vulnerability

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

Dolibarr is an open-source ERP and CRM software designed for small and medium-sized businesses. It provides various features such as accounting, inventory management, project management, and more. This vulnerability affects Dolibarr versions prior to 7.0.2.

Vulnerability Detail

The vulnerability in Dolibarr allows remote attackers to execute arbitrary SQL commands through several endpoints, including accountmodel.php, categories_list.php, journals_list.php, dict.php, mails_templates.php, and website.php. The vulnerability arises due to insufficient input validation of the 'sortfield' parameter. By exploiting this vulnerability, an attacker can manipulate the SQL queries and potentially gain unauthorized access to the database or perform other malicious actions.

composer require dolibarr/dolibarr:7.0.2

Workaround

If upgrading to the latest version is not immediately feasible, users can apply the following workaround to mitigate the risk: Implement input validation and sanitization for the 'sortfield' parameter in the affected endpoints. This can be done by using prepared statements or parameterized queries to prevent SQL injection attacks. Here is an example of how to use prepared statements in PHP:

$sortfield = $_GET['sortfield'];

$stmt = $pdo->prepare('SELECT * FROM table WHERE sortfield = :sortfield');
$stmt->bindParam(':sortfield', $sortfield);
$stmt->execute();

// Process the results

Conclusion

The SQL Injection vulnerability in Dolibarr before version 7.0.2 poses a significant risk to the security of the system. It is crucial for users to upgrade to the latest version or apply the recommended workaround to mitigate the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for dolibarr/dolibarr →

FAQ