Vulnerability Description
Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sortfield, (2) sortorder, and (3) sall parameters to user/index.php and (b) user/group/index.php; the id parameter to (4) info.php, (5) perms.php, (6) param_ihm.php, (7) note.php, and (8) fiche.php in user/; and (9) rowid parameter to admin/boxes.php.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dolibarr | Dolibarr Erp\/Crm | <= 3.1.0 |
Related Weaknesses (CWE)
References
- http://osvdb.org/77340Broken Link
- http://osvdb.org/77341Broken Link
- http://osvdb.org/77342Broken Link
- http://osvdb.org/77343Broken Link
- http://osvdb.org/77344Broken Link
- http://osvdb.org/77345Broken Link
- http://osvdb.org/77346Broken LinkExploit
- http://osvdb.org/77347Broken LinkExploit
- http://www.securityfocus.com/archive/1/520619/100/0/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/50777ExploitThird Party AdvisoryVDB Entry
- https://github.com/Dolibarr/dolibarr/commit/63820ab37537fdff842539425b2bf2881f0dExploitPatch
- https://github.com/Dolibarr/dolibarr/commit/762f98ab4137749d0993612b4e3544a4207eExploitPatch
- https://github.com/Dolibarr/dolibarr/commit/c539155d6ac2f5b6ea75b87a16f298c0090eExploitPatch
- https://github.com/Dolibarr/dolibarr/commit/d08d28c0cda1f762a47cc205d4363de03df1ExploitPatch
- https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_dolibarr.htmlExploit
FAQ
What is CVE-2011-4802?
CVE-2011-4802 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sortfield, (2) sortorder, and (3) sall p...
How severe is CVE-2011-4802?
CVE-2011-4802 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-4802?
Check the references section above for vendor advisories and patch information. Affected products include: Dolibarr Dolibarr Erp\/Crm.