Description

Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sortfield, (2) sortorder, and (3) sall parameters to user/index.php and (b) user/group/index.php; the id parameter to (4) info.php, (5) perms.php, (6) param_ihm.php, (7) note.php, and (8) fiche.php in user/; and (9) rowid parameter to admin/boxes.php.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/77340Broken Link
http://osvdb.org/77341Broken Link
http://osvdb.org/77342Broken Link
http://osvdb.org/77343Broken Link
http://osvdb.org/77344Broken Link
http://osvdb.org/77345Broken Link
http://osvdb.org/77346Broken Link, Exploit
http://osvdb.org/77347Broken Link, Exploit
http://www.securityfocus.com/archive/1/520619/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/50777Exploit, Third Party Advisory, VDB Entry
https://github.com/Dolibarr/dolibarr/commit/63820ab37537fdff842539425b2bf2881f0d8e91Exploit, Patch
https://github.com/Dolibarr/dolibarr/commit/762f98ab4137749d0993612b4e3544a4207e78a1Exploit, Patch
https://github.com/Dolibarr/dolibarr/commit/c539155d6ac2f5b6ea75b87a16f298c0090e535aExploit, Patch
https://github.com/Dolibarr/dolibarr/commit/d08d28c0cda1f762a47cc205d4363de03df16675Exploit, Patch
https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_dolibarr.htmlExploit
http://osvdb.org/77340Broken Link
http://osvdb.org/77341Broken Link
http://osvdb.org/77342Broken Link
http://osvdb.org/77343Broken Link
http://osvdb.org/77344Broken Link
http://osvdb.org/77345Broken Link
http://osvdb.org/77346Broken Link, Exploit
http://osvdb.org/77347Broken Link, Exploit
http://www.securityfocus.com/archive/1/520619/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/50777Exploit, Third Party Advisory, VDB Entry
https://github.com/Dolibarr/dolibarr/commit/63820ab37537fdff842539425b2bf2881f0d8e91Exploit, Patch
https://github.com/Dolibarr/dolibarr/commit/762f98ab4137749d0993612b4e3544a4207e78a1Exploit, Patch
https://github.com/Dolibarr/dolibarr/commit/c539155d6ac2f5b6ea75b87a16f298c0090e535aExploit, Patch
https://github.com/Dolibarr/dolibarr/commit/d08d28c0cda1f762a47cc205d4363de03df16675Exploit, Patch
https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_dolibarr.htmlExploit

Timeline

Published: Dec 14, 2011
Last modified: Jun 16, 2026
NVD status: Modified

CVE-2011-4802