CVE-2018-13450

SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statusbatch parameter...

CVE-2018-13447

SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut parameter...

CVE-2018-13449

SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statutbuy parameter...

CVE-2018-13448

SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the countryid parameter...

CVE-2018-13449

CVE-2018-13449 is a Dolibarr ERP/CRM 7.0.3 vulnerability in the file product/card.php: a SQL injection via the statut_buy parameter allows remote attackers to execute arbitrary SQL commands. The entry is supported by multiple sources (NVD and OSS entries) indicating a high-severity, network-expos...

CVE-2018-13447

CVE-2018-13447 : Dolibarr ERP/CRM 7.0.3 contains a SQL injection in product/card.php via the statut parameter, allowing remote attackers to execute arbitrary SQL commands. CVSS v3.0 base score 9.8 (CRITICAL); vector: NETWORK, LOW attack complexity, no authentication, with HIGH impact on confident...

CVE-2018-13450

CVE-2018-13450 affects Dolibarr ERP/CRM, specifically version 7.0.3. An SQL injection vulnerability exists in the file product/card.php via the status_batch parameter, allowing remote attackers to execute arbitrary SQL commands. The issue is evidenced by multiple connected sources (NVD entry reit...

CVE-2018-13448

Dolibarr ERP/CRM 7.0.3 is affected by an SQL injection in product/card.php via the country_id parameter, enabling remote arbitrary SQL execution. The issue is confirmed across multiple sources (NVD entry CVE-2018-13448, OSV/Ubuntu/Nessus references) and is categorized with a high/severe impact (C...

PT-2018-11830 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 7.0.3 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the statut parameter in the product/card.php file. Recommendations: For Dolibarr ERP/CRM version 7.0.3, avoi...

Dolibarr ERP CRM < 7.0.3 - PHP Code Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Unauthenticated Remote Code Evaluation in Dolibarr ERP CRM =7.0.3 Exploit Author: om3rcitak - https://omercitak.com Vendor Homepage: https://dolibarr.org Software Link: https://github.com/Dolibarr/dolibarr Version: =7.0.3 Tested...

Dolibarr ERP CRM 7.0.3 Code Injection

Exploit Title: Unauthenticated Remote Code Evaluation in Dolibarr ERP CRM =7.0.3 Date: 06/29/2018 Exploit Author: om3rcitak - https://omercitak.com Vendor Homepage: https://dolibarr.org Software Link: https://github.com/Dolibarr/dolibarr Version: =7.0.3 Tested on: Unix, Windows Technical Details...

Dolibarr ERPCRM 7.0.3 - PHP Code Injection

Dolibarr ERPCRM 7.0.3 - PHP Code Injection Exploit Title: Unauthenticated Remote Code Evaluation in Dolibarr ERP CRM =7.0.3 Date: 06/29/2018 Exploit Author: om3rcitak - https://omercitak.com Vendor Homepage: https://dolibarr.org Software Link: https://github.com/Dolibarr/dolibarr Version: =7.0.3...

Dolibarr ERP/CRM < 7.0.3 - PHP Code Injection

Exploit Title: Unauthenticated Remote Code Evaluation in Dolibarr ERP CRM =7.0.3 Date: 06/29/2018 Exploit Author: om3rcitak - https://omercitak.com Vendor Homepage: https://dolibarr.org Software Link: https://github.com/Dolibarr/dolibarr Version: =7.0.3 Tested on: Unix, Windows Technical Details...

Dolibarr ERPCRM 7.0.0 - (Authenticated) SQL Injection

Dolibarr ERPCRM 7.0.0 - Authenticated SQL Injection CVE-2018-10094 Dolibarr SQL Injection vulnerability Description Dolibarr is an "Open Source ERP & CRM for Business" used by many companies worldwide. It is available through GitHub or as distribution packages e.g .deb package. Threat The...

Dolibarr ERP/CRM 7.0.0 - (Authenticated) SQL Injection

CVE-2018-10094 Dolibarr SQL Injection vulnerability Description Dolibarr is an "Open Source ERP & CRM for Business" used by many companies worldwide. It is available through GitHub or as distribution packages e.g .deb package. Threat The application does not handle user input properly and allows...

Dolibarr 7.0.0 Admin Panel Remote Code Execution

CVE-2018-10092 Dolibarr admin panel authenticated Remote Code Execution RCE vulnerability Description Dolibarr is an "Open Source ERP & CRM for Business" used by many companies worldwide. It is available through GitHub or as distribution packages e.g .deb package. Threat By tricking a logged-in...

Dolibarr 7.0.0 Cross Site Scripting

CVE-2018-10095 Dolibarr XSS Injection vulnerability Description Dolibarr is an "Open Source ERP & CRM for Business" used by many companies worldwide. It is available through GitHub or as distribution packages e.g .deb package. Threat The application does not handle user input properly, allowing...

Dolibarr < 7.0.2 Multiple Vulnerabilities

Dolibarr is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dolibarr:dolibarr"; if description...

SQL Injection

dolibarr/dolibarr is vulnerable to SQL injection attacks. The vulnerability exists through the sortfield parameter which affects /accountancy/admin/accountmodel.php, /accountancy/admin/categorieslist.php, /accountancy/admin/journalslist.php, /admin/dict.php, /admin/mailstemplates.php, and...

Cross-site Scripting (XSS)

dolibarr/dolibarr is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of proper escaping in the variables of carte.php, allowing arbitrary scripts to be executed...