CVE-2024-5315: Dolibarr ERP - CRM SQL Injection Vulnerability
Summary
CVE-2024-5315: Dolibarr vulnerable to SQL Injection. Affects dolibarr/dolibarr versions < 9.0.1. No fix is published. How to fix ↓
Also tracked for
- dolibarr · Bitnami
The same CVE-2024-5315 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr ERP - CRM is an open-source software package that provides enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is widely used for managing various business processes, including sales, inventory, invoicing, and more. The package is available on Packagist and can be installed via Composer. Unfortunately, Dolibarr version 9.0.1 is vulnerable to SQL injection attacks.
Vulnerability Detail
The vulnerability in Dolibarr ERP - CRM version 9.0.1 allows remote attackers to exploit SQL injection flaws. By sending specially crafted SQL queries through the parameters in the 'list.php' file located at '/dolibarr/commande/list.php', an attacker can manipulate the SQL statements executed by the system. This can lead to unauthorized access to the database and retrieval of sensitive information stored within. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advised to implement input validation and parameterized queries to prevent SQL injection attacks. By properly sanitizing user input and using prepared statements or parameter binding, the risk of SQL injection can be significantly reduced. Here is an example of how to use parameterized queries in PHP:
$statement = $pdo->prepare('SELECT * FROM users WHERE username = :username AND password = :password');
$statement->execute([
'username' => $username,
'password' => $password
]);
$result = $statement->fetchAll();
By using prepared statements, the input values are automatically escaped, preventing SQL injection.
Conclusion
In conclusion, Dolibarr ERP - CRM version 9.0.1 is vulnerable to SQL injection attacks, which can lead to unauthorized access to the database and retrieval of sensitive information. It is highly recommended to upgrade to a secure version of Dolibarr that includes the necessary patches. Implementing input validation and parameterized queries can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr ERP - CRM is an open-source software package that provides enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is widely used for managing various business processes, including sales, inventory, invoicing, and more.
SQL injection is a type of security vulnerability that allows an attacker to manipulate SQL statements executed by a web application's database. By injecting malicious SQL code, an attacker can bypass security measures and gain unauthorized access to the database, potentially retrieving sensitive information or modifying data.
This vulnerability in Dolibarr ERP - CRM version 9.0.1 allows remote attackers to exploit SQL injection flaws. By sending specially crafted SQL queries, an attacker can retrieve all the information stored in the database, potentially exposing sensitive data and compromising the integrity of the system.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.1. This indicates a high level of risk and emphasizes the importance of promptly addressing the issue to prevent potential exploitation.
To mitigate the risk of SQL injection attacks, it is crucial to implement proper input validation and use parameterized queries or prepared statements. By validating and sanitizing user input and ensuring that SQL queries are constructed using placeholders, the risk of SQL injection can be significantly reduced.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
