CVE-2017-17900
CriticalSummary
Version 6.0.4 of Dolibarr ERP/CRM contains an SQL injection vulnerability in fourn/index.php that allows remote attackers to execute arbitrary SQL commands via the socid parameter.
Risk Assessment
Attackers can exploit this vulnerability to gain unauthorized access to the database, potentially leading to the disclosure of sensitive information or data manipulation.
Recommendation
It is recommended to update Dolibarr ERP/CRM to the latest version to mitigate this vulnerability and implement additional security measures such as input validation.
Other vulnerabilities in Dolibarr ERP/CRM version 6.0.4
See all- CVE-2017-14240High
There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter.
- CVE-2017-17899Critical
An SQL injection vulnerability in Dolibarr ERP/CRM version 6.0.4 in adherents/subscription/info.php allows remote attackers to execute arbitrary SQL commands via the rowid parameter.
- CVE-2017-17897Critical
SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- CVE-2017-14238Critical
SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId parameter.
Original NVD description (English source)
SQL injection vulnerability in fourn/index.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the socid parameter.