CVE-2024-5314 — SQL Injection in Dolibarr

CWE-89 — SQL Injection6 documents5 sources
Severity
9.1CRITICALNVD
EPSS
0.2%
top 56.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
DolibarrDolibarr ERP CMSDolibarr ERP CRM
Timeline
PublishedMay 24

Description

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in /dolibarr/admin/dict.php.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages3 packages

▶Packagistdolibarr/dolibarr9.0.1
▶CVEListV5dolibarr/erp_cms9.0.1

🔴Vulnerability Details

4
OSV
CVE-2024-5314: Vulnerabilities in Dolibarr ERP - CRM that affect version 9↗2024-05-24
▶
CVEList
Multiple vulnerabilities in DOLIBARR's ERP CMS↗2024-05-24
▶
OSV
Dolibarr vulnerable to SQL Injection↗2024-05-24
▶
GHSA
Dolibarr vulnerable to SQL Injection↗2024-05-24
▶

💬Community

1
Bugzilla
CVE-2024-26939 kernel: drm/i915/vma: Fix UAF on destroy against retire race↗2024-05-01
▶
CVE-2024-5314 — SQL Injection in Dolibarr | cvebase