vendor:
Dolibarr
by:
N/A
9.8
CVSS
CRITICAL
SQL Injection
89
CWE
Product Name: Dolibarr
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: CVE-2018-10094
CPE: N/A
Metasploit:
N/A
Other Scripts:
https://www.infosecmatter.com/metasploit-module-library/?mm=auxiliary/gather/dolibarr_creds_sqli, https://www.infosecmatter.com/nessus-plugin-library/?id=120181, https://www.infosecmatter.com/nessus-plugin-library/?id=119866, https://www.infosecmatter.com/nessus-plugin-library/?id=119807, https://www.infosecmatter.com/nessus-plugin-library/?id=119718, https://www.infosecmatter.com/nessus-plugin-library/?id=110741, https://www.infosecmatter.com/nessus-plugin-library/?id=133359, https://www.infosecmatter.com/metasploit-auxiliary-modules-detailed-spreadsheet/
Platforms Tested: N/A
2018
[CVE-2018-10094] Dolibarr SQL Injection vulnerability
Dolibarr is an 'Open Source ERP & CRM for Business' used by many companies worldwide. It is available through GitHub or as distribution packages (e.g .deb package). The application does not handle user input properly and allows execution of arbitrary SQL commands on the database. Prepared queries should be used in order to avoid SQL injection in user input.
Mitigation:
Prepared queries should be used in order to avoid SQL injection in user input.