Lucene search

[email protected]CVE-2011-4802

HistoryDec 14, 2011 - 12:55 a.m.

CVE-2011-4802

2011-12-1400:55:04

CWE-89

[email protected]

web.nvd.nist.gov

cve-2011-4802

sql injection

dolibarr 3.1.0 rc

security vulnerability

remote authenticated users

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.3 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

56.7%

JSON

Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sortfield, (2) sortorder, and (3) sall parameters to user/index.php and (b) user/group/index.php; the id parameter to (4) info.php, (5) perms.php, (6) param_ihm.php, (7) note.php, and (8) fiche.php in user/; and (9) rowid parameter to admin/boxes.php.

Affected configurations

NVD

Node

dolibarrdolibarr_erp\/crmRange≤3.1.0rc

dolibarrdolibarr_erp\/crmMatch2.5.0

dolibarrdolibarr_erp\/crmMatch2.6.0

dolibarrdolibarr_erp\/crmMatch2.6.1

dolibarrdolibarr_erp\/crmMatch2.7.0

dolibarrdolibarr_erp\/crmMatch2.7.1

dolibarrdolibarr_erp\/crmMatch2.8.0

dolibarrdolibarr_erp\/crmMatch2.8.1

dolibarrdolibarr_erp\/crmMatch2.9.0

dolibarrdolibarr_erp\/crmMatch3.0.0

dolibarrdolibarr_erp\/crmMatch3.0.1

CPENameOperatorVersion
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp/crmle3.1.0
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp/crmeq2.5.0
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp/crmeq2.6.0
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp/crmeq2.6.1
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp/crmeq2.7.0
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp/crmeq2.7.1
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp/crmeq2.8.0
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp/crmeq2.8.1
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp/crmeq2.9.0
dolibarr:dolibarr_erp\/crmdolibarr dolibarr erp/crmeq3.0.0

CPE	Name	Operator	Version
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp/crm	le	3.1.0
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp/crm	eq	2.5.0
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp/crm	eq	2.6.0
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp/crm	eq	2.6.1
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp/crm	eq	2.7.0
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp/crm	eq	2.7.1
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp/crm	eq	2.8.0
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp/crm	eq	2.8.1
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp/crm	eq	2.9.0
dolibarr:dolibarr_erp\/crm	dolibarr dolibarr erp/crm	eq	3.0.0

Rows per page:

1-10 of 111

References

osvdb.org/77340

osvdb.org/77341

osvdb.org/77342

osvdb.org/77343

osvdb.org/77344

osvdb.org/77345

osvdb.org/77346

osvdb.org/77347

www.securityfocus.com/archive/1/520619/100/0/threaded

www.securityfocus.com/bid/50777

github.com/Dolibarr/dolibarr/commit/63820ab37537fdff842539425b2bf2881f0d8e91

github.com/Dolibarr/dolibarr/commit/762f98ab4137749d0993612b4e3544a4207e78a1

github.com/Dolibarr/dolibarr/commit/c539155d6ac2f5b6ea75b87a16f298c0090e535a

github.com/Dolibarr/dolibarr/commit/d08d28c0cda1f762a47cc205d4363de03df16675

www.htbridge.ch/advisory/multiple_vulnerabilities_in_dolibarr.html

Social References

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.3 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

56.7%

JSON

Related for CVE-2011-4802

prion1 cvelist1 nvd1 openvas1 htbridge1