Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in /dolibarr/admin/dict.php.
References
| Link | Resource |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dolibarrs-erp-cms | Third Party Advisory |
| https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dolibarrs-erp-cms | Third Party Advisory |
Configurations
History
10 Apr 2025, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
| CWE | CWE-89 |
04 Mar 2025, 17:00
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | ||
| References | () https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dolibarrs-erp-cms - Third Party Advisory | |
| First Time |
Dolibarr
Dolibarr dolibarr Erp\/crm |
|
| CPE | cpe:2.3:a:dolibarr:dolibarr_erp\/crm:9.0.1:*:*:*:*:*:*:* |
24 May 2024, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-24 10:15
Updated : 2025-04-10 19:17
NVD link : CVE-2024-5314
Mitre link : CVE-2024-5314
JSON object : View
Products Affected
dolibarr
- dolibarr_erp\/crm
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')