SQL Injection Affecting dolibarr/dolibarr package, versions >=3.8.0, <7.0.1


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Mature
EPSS
0.21% (61st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about SQL Injection vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-PHP-DOLIBARRDOLIBARR-173766
  • published7 Mar 2019
  • disclosed7 Mar 2019
  • creditRomain Koszyk, Erwan Robin, chqrly from DIGITEMIS CYBERSECURITY and PRIVACY.

Introduced: 7 Mar 2019

CVE-2018-16809  (opens in a new tab)
CWE-89  (opens in a new tab)

How to fix?

Upgrade dolibarr/dolibarr to version 7.0.1 or higher.

Overview

dolibarr/dolibarr is a modern and easy to use web software to manage your business.

Affected versions of this package are vulnerable to SQL Injection via the integer parameters qty and value_unit. When editing a billing at /expensereport/card.phpid=$id_integer&action=editline&rowid=$rowid_integer, the POST parameters fail to properly sanitise the parameters due to the application using a recursive call to an eregi() or a preg_match() regex to determine the legitimacy of the query being processed. This allows the integer parameters qty, value_unit to be abused efficiently.

References

CVSS Scores

version 3.1