CVE-2013-2091

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
dolibarr	dolibarr	3.3.1

References

http://www.openwall.com/lists/oss-security/2013/05/14/3Mailing List, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/84248Third Party Advisory, VDB Entry
https://github.com/Dolibarr/dolibarr/commit/9427e32e2ed54c1a2bc519a88c057207836df489Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2013-2091Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/05/14/3Mailing List, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/84248Third Party Advisory, VDB Entry
https://github.com/Dolibarr/dolibarr/commit/9427e32e2ed54c1a2bc519a88c057207836df489Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2013-2091Third Party Advisory

Timeline

Published: Nov 20, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-20926.1Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php.CVE-2013-20939.8Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute a CVE-2013-20948.4The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows lo CVE-2013-20959.8rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injection CVE-2013-20962.1OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause a CVE-2013-20977.8ZPanel through 10.1.0 has Remote Command Execution CVE-2013-20994.3Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of pyt CVE-2013-21009.3The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL CVE-2013-21015.4Katello has multiple XSS issues in various entities CVE-2013-21023.3The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a JGroups CVE-2013-21038.1OpenShift cartridge allows remote URL retrieval CVE-2013-21045.5python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remo