CVE-2018-10094

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2018/05/21/1Exploit, Mailing List
https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLogRelease Notes
https://github.com/Dolibarr/dolibarr/commit/7ade4e37f24d6859987bb9f6232f604325633fddPatch
https://sysdream.com/news/lab/2018-05-21-cve-2018-10094-dolibarr-sql-injection-vulnerability/Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/44805/Exploit, Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2018/05/21/1Exploit, Mailing List
https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLogRelease Notes
https://github.com/Dolibarr/dolibarr/commit/7ade4e37f24d6859987bb9f6232f604325633fddPatch
https://sysdream.com/news/lab/2018-05-21-cve-2018-10094-dolibarr-sql-injection-vulnerability/Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/44805/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: May 22, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-100956.1Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the for CVE-2018-100964.8joyplus-cms 1.6.0 has XSS via the device_name parameter in a manager/admin_ajax.php?action=save flag=add request.CVE-2018-100976.1XSS exists in Domain Trader 2.5.3 via the recoverlogin.php email_address parameter.CVE-2018-100985.5In MicroWorld eScan Internet Security Suite (ISS) for Business 14.0.1400.2029, the driver econceal.sys allows a non-privileged user to send CVE-2018-100995.3Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculat CVE-2018-10108.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso CVE-2018-101006.1Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.CVE-2018-101016.1Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.CVE-2018-101026.1Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.CVE-2018-101039.8tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2).CVE-2018-101059.8tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2).CVE-2018-101069.8D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have permission bypass and information disclosure