CVE-2018-13449

SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statutbuy parameter...

CVE-2018-13449

CVE-2018-13449 is a Dolibarr ERP/CRM 7.0.3 vulnerability in the file product/card.php: a SQL injection via the statut_buy parameter allows remote attackers to execute arbitrary SQL commands. The entry is supported by multiple sources (NVD and OSS entries) indicating a high-severity, network-expos...

CVE-2018-13450

SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statusbatch parameter...

CVE-2018-13447

SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut parameter...

CVE-2018-13448

SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the countryid parameter...

CVE-2018-13449

SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statutbuy parameter...

CVE-2018-13447

CVE-2018-13447 : Dolibarr ERP/CRM 7.0.3 contains a SQL injection in product/card.php via the statut parameter, allowing remote attackers to execute arbitrary SQL commands. CVSS v3.0 base score 9.8 (CRITICAL); vector: NETWORK, LOW attack complexity, no authentication, with HIGH impact on confident...

CVE-2018-13448

Dolibarr ERP/CRM 7.0.3 is affected by an SQL injection in product/card.php via the country_id parameter, enabling remote arbitrary SQL execution. The issue is confirmed across multiple sources (NVD entry CVE-2018-13448, OSV/Ubuntu/Nessus references) and is categorized with a high/severe impact (C...

CVE-2018-13450

CVE-2018-13450 affects Dolibarr ERP/CRM, specifically version 7.0.3. An SQL injection vulnerability exists in the file product/card.php via the status_batch parameter, allowing remote attackers to execute arbitrary SQL commands. The issue is evidenced by multiple connected sources (NVD entry reit...

newbase-erp-software.nl XSS vulnerability

Open Bug Bounty ID: OBB-641621 Description| Value ---|--- Affected Website:| newbase-erp-software.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Dolibarr ERP CRM < 7.0.3 - PHP Code Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Unauthenticated Remote Code Evaluation in Dolibarr ERP CRM =7.0.3 Exploit Author: om3rcitak - https://omercitak.com Vendor Homepage: https://dolibarr.org Software Link: https://github.com/Dolibarr/dolibarr Version: =7.0.3 Tested...

Dolibarr ERPCRM 7.0.3 - PHP Code Injection

Dolibarr ERPCRM 7.0.3 - PHP Code Injection Exploit Title: Unauthenticated Remote Code Evaluation in Dolibarr ERP CRM =7.0.3 Date: 06/29/2018 Exploit Author: om3rcitak - https://omercitak.com Vendor Homepage: https://dolibarr.org Software Link: https://github.com/Dolibarr/dolibarr Version: =7.0.3...

U.S. sanctions against Russian cybersecurity companies

I never thought that I will write here about state sanctions. Usually I try to ignore political topics. But now it's necessary. Yesterday OFAC introduced sanctions against 5 Russian companies. I would like to mention 3 of them: Digital Security - one of the leading Russian Information Security...

Dolibarr Gather Credentials via SQL Injection

This module enables an authenticated user to collect the usernames and encrypted passwords of other users in the Dolibarr ERP/CRM via SQL injection. Module Options msf use auxiliary/gather/dolibarr/credssqli msf undefinedcredssqli show actions ...actions... msf undefinedcredssqli set ACTION msf...

Dolibarr 7.0.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications CVE-2018-10094 Dolibarr SQL Injection vulnerability Description Dolibarr is an "Open Source ERP & CRM for Business" used by many companies worldwide. It is available through GitHub or as distribution packages e.g .deb package. Threat The...

Dolibarr 7.0.0 Cross Site Scripting

CVE-2018-10095 Dolibarr XSS Injection vulnerability Description Dolibarr is an "Open Source ERP & CRM for Business" used by many companies worldwide. It is available through GitHub or as distribution packages e.g .deb package. Threat The application does not handle user input properly, allowing...

Dolibarr 7.0.0 Admin Panel Remote Code Execution

CVE-2018-10092 Dolibarr admin panel authenticated Remote Code Execution RCE vulnerability Description Dolibarr is an "Open Source ERP & CRM for Business" used by many companies worldwide. It is available through GitHub or as distribution packages e.g .deb package. Threat By tricking a logged-in...

Dolibarr 7.0.0 SQL Injection

CVE-2018-10094 Dolibarr SQL Injection vulnerability Description Dolibarr is an "Open Source ERP & CRM for Business" used by many companies worldwide. It is available through GitHub or as distribution packages e.g .deb package. Threat The application does not handle user input properly and allows...

erp-associates.com XSS vulnerability

Open Bug Bounty ID: OBB-618387 Description| Value ---|--- Affected Website:| erp-associates.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-9838

Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting XSS vulnerabilities in versions before 5.0.4: index.php leftmenu parameter, core/ajax/box.php PATHINFO, product/stats/card.php type parameter, holiday/list.php monthcreate, monthstart, and monthend parameters, and don/card.ph...