CVE-2017-17897
CriticalSummary
SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Risk Assessment
Attackers may gain access to sensitive data or manipulate the database, leading to serious security implications for the organization.
Recommendation
It is recommended to update Dolibarr ERP/CRM to the latest version to eliminate this vulnerability and implement input data filtering in the application.
Other vulnerabilities in Dolibarr ERP/CRM version 6.0.4
See all- CVE-2017-14240High
There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter.
- CVE-2017-17900Critical
Version 6.0.4 of Dolibarr ERP/CRM contains an SQL injection vulnerability in fourn/index.php that allows remote attackers to execute arbitrary SQL commands via the socid parameter.
- CVE-2017-17899Critical
An SQL injection vulnerability in Dolibarr ERP/CRM version 6.0.4 in adherents/subscription/info.php allows remote attackers to execute arbitrary SQL commands via the rowid parameter.
- CVE-2017-14238Critical
SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId parameter.
Original NVD description (English source)
SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.