CVE-2024-5314: Dolibarr ERP - CRM SQL Injection Vulnerability
Summary
CVE-2024-5314: Dolibarr vulnerable to SQL Injection. Affects dolibarr/dolibarr versions < 9.0.1. No fix is published. How to fix ↓
Also tracked for
- dolibarr · Bitnami
The same CVE-2024-5314 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr ERP - CRM is an open-source software package that provides enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is widely used by businesses to manage various aspects of their operations, including sales, inventory, invoicing, and more. Dolibarr is written in PHP and relies on a MySQL database for data storage. However, version 9.0.1 of Dolibarr is vulnerable to SQL injection attacks.
Vulnerability Detail
The vulnerability in Dolibarr ERP - CRM version 9.0.1 allows for SQL injection attacks. An attacker can exploit this vulnerability by sending a specially crafted SQL query through the 'sortorder' and 'sortfield' parameters in the '/dolibarr/admin/dict.php' endpoint. By manipulating these parameters, the attacker can execute arbitrary SQL queries and retrieve sensitive information stored in the database. This could include customer data, financial records, and other confidential information. The impact of this vulnerability is critical, as it can lead to unauthorized access and data leakage.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement input validation and sanitization mechanisms to filter out potentially malicious input. This can help mitigate the risk of SQL injection attacks. However, this should be considered a temporary solution, and upgrading to a patched version is strongly advised.
Conclusion
The SQL injection vulnerability in Dolibarr ERP - CRM version 9.0.1 poses a significant risk to the security and integrity of the system. It allows attackers to execute arbitrary SQL queries and retrieve sensitive information from the database. To mitigate this risk, it is crucial to upgrade to a patched version of Dolibarr and follow secure coding practices. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr ERP - CRM is an open-source software package that provides enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is widely used by businesses to manage various aspects of their operations, including sales, inventory, invoicing, and more.
SQL injection is a type of security vulnerability that allows an attacker to manipulate SQL queries executed by a web application. By injecting malicious SQL code, an attacker can bypass security measures and gain unauthorized access to the application's database.
The SQL injection vulnerability in Dolibarr ERP - CRM can lead to unauthorized access to sensitive information stored in the database. This includes customer data, financial records, and other confidential information. The impact can be severe, resulting in data breaches, financial loss, and reputational damage.
To protect your Dolibarr installation, it is crucial to upgrade to a patched version that addresses this vulnerability. Additionally, implementing input validation and sanitization mechanisms in custom code or extensions can help prevent SQL injection attacks.
Yes, you can use Vulert's vulnerability monitoring service to check if your Dolibarr installation is affected by this vulnerability. Vulert uses composer.lock to monitor and alert in real-time for open-source vulnerabilities, providing you with timely information and recommendations for remediation.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
