vendor:
Dolibarr ERP/CRM
by:
Metin Yunus Kandemir (kandemir)
8.8
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Dolibarr ERP/CRM
Affected Version From: 10.0.1
Affected Version To: 10.0.1
Patch Exists: YES
Related CWE: N/A
CPE: a:dolibarr:dolibarr:10.0.1
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Xampp for Linux
2019
Dolibarr ERP/CRM – Multiple Sql Injection
Dolibarr ERP/CRM is vulnerable to multiple SQL injection attacks. An attacker can exploit this vulnerability by sending a specially crafted HTTP request with malicious payloads in the actioncode parameter. This can allow the attacker to execute arbitrary SQL commands on the underlying database.
Mitigation:
Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.