Dolibarr vulnerabilities

An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.

CVE-2017-14242 is an SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 that allows remote attackers to execute arbitrary SQL commands via the statut parameter.

Dolibarr versions 9.0.0 through 23.0.4 save inbound email attachments under the name supplied in MIME headers without reducing it to a safe basename. The saveAttachment() functions in htdocs/emailcollector/lib/emailcollector.lib.php and htdocs/emailcollector/class/emailcollector.class.php build the file path from the attachment name, which may contain path traversal sequences, allowing writes outside the target directory.

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() calls dol_check_secure_access_document() with mode 'read' instead of 'write', allowing an authenticated user with only read permissions to permanently delete module documents.

Dolibarr before 24.0.0 contains a SQL injection vulnerability in its CSV and XLSX import wizard. The wizard reads update keys via GETPOST('updatekeys', 'array') in htdocs/imports/import.php, applying only the generic alphanohtml filter that leaves SQL keywords, comment markers, parentheses, spaces, and quotes intact. The import_insert() function in htdocs/core/modules/import/import_csv.modules.php builds a filter with $where[] = $key.' = '.$data[$key] and executes it via $this->db->query(), allowing SQL injection.

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actions_massactions.inc.php. Authenticated users with project creation permission but without access to a target private project can exploit the flawed !in_array() check to clone tasks into unauthorized private projects.

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API. Authenticated attackers with member-read rights can retrieve bcrypt password verifiers by querying member endpoints. The verifier fields are not filtered by the base API serializer or the Members API class, enabling offline password cracking.

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API. Authenticated attackers with user-read rights can extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search on numeric fields and LIKE prefix iteration on string fields to recover salary figures and password verifiers, while raw database errors enable column name enumeration.

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint. Authenticated attackers with expense-creation rights can bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can manipulate workflow state fields to advance expense reports to approved or closed status without possessing the dedicated approval right, while also creating forensic inconsistencies in audit records due to missing approval timestamps.

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint. Attackers with user-write rights can modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourly rate, daily rate, and weekly hours for any user without holding payroll rights, with the modified values appearing in payroll export reports.

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes. Authenticated attackers with third-party creation rights can create, replace, or delete bank account details of any company without requiring read access to that company. Attackers can inject attacker-controlled IBANs as creditor accounts, which are then written into regenerated SEPA credit-transfer files, redirecting outgoing payments to attacker-controlled accounts.

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can zero paid amounts on invoices and remove entries from accounting exports, causing financial data integrity loss.

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company's WebPortal password, authenticate as that company to access its invoice data, and also obtain the victim's previous password verifier from the API response.

Dolibarr before version 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows an attacker with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder.

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticated attacker can cause an authenticated administrator to open a crafted URL to execute arbitrary JavaScript in that session and create a persistent administrator account.

A weakness has been identified in Dolibarr up to 23.0.4 in the file htdocs/user/card.php of the Account Handler component. Manipulation of the ID argument causes improper authorization. The attack can be initiated remotely, and the exploit is publicly available. Upgrading to version 24.0.0 mitigates the issue.

A security flaw has been discovered in Dolibarr up to 23.0.3. The unknown function in the User Cloning component of htdocs/user/card.php is affected. Manipulation of the ID argument results in LDAP injection. The attack can be launched remotely. The exploit has been publicly released and may be used. A patch is available.

Dolibarr up to version 23.0.3 (fixed in commit 14db36e) contains a SQL injection vulnerability. Authenticated API users can exfiltrate arbitrary database contents by supplying malicious values to the sqlfilters query parameter in the setup dictionary and multicurrencies REST API endpoints.