CVE-2017-17899

Dolibarr ERP/CRM 6.0.4 contains an SQL injection in adherents/subscription/info.php via the rowid parameter, enabling remote attackers to execute arbitrary SQL commands. This is documented across multiple sources (NVD/NVD-derived entries, OSV, GHSA). Reported impact includes potential exposure of...

CVE-2017-17897

Dolibarr ERP/CRM 6.0.4 is affected by a SQL injection in comm/multiprix.php via the id parameter, allowing remote attackers to run arbitrary SQL. Affected component: Dolibarr’s multiprix module; root cause: unparameterized SQL built with user-supplied id. Exploitation: remote, no authentication r...

CVE-2017-17900

SQL injection vulnerability in fourn/index.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the socid parameter...

CVE-2017-17899

SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the rowid parameter...

CVE-2017-17897

SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter...

PT-2017-15082 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 6.0.4 Description: A SQL injection issue allows remote attackers to execute arbitrary SQL commands. The issue is related to the id parameter in the comm/multiprix.php file. Recommendations: For version 6.0.4, consider...

PT-2017-15084 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 6.0.4 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the rowid parameter in the adherents/subscription/info.php file. Recommendations: For version 6.0.4, conside...

PT-2017-15085 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 6.0.4 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the socid parameter in the 'fourn/index.php' file. Recommendations: For Dolibarr ERP/CRM version 6.0.4,...

PT-2017-15083 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 6.0.4 Description: The issue allows remote attackers to obtain sensitive information by making direct requests to .tpl.php files, which are not blocked. Recommendations: For version 6.0.4, consider restricting access ...

Cross-site Scripting (XSS)

Dolibarr is vulnerable to cross-site scripting XSS attacks. The QUERYSTRING parameter is not escaped for pages being called with ajax. This allows attackers to inject and execute arbitrary webscript...

SQL Injection

Dolibarr is vulnerable to multiple SQL injection attacks. The searchcountry, searchtypethirdparty, viewstatut, viewstatut, searchsale, and searchuser user-supplied values are not escaped before being placed into an SQL statement...

Cross-site Scripting

dolibarr is vulnerable to cross-site scripting attacks. The attack exists because it does not correctly filter the "url" field through the external calendar or 2 the bank name field in the "import external calendar" page, allowing the attacker to inject arbitrary script through them...

SQL Injection

dolibarr is susceptible to SQL injection attacks. The attacker can execute arbitrary SQL queries through the style.css.php and translate.class.php files because the library does not filter the lang and defaultlang attributes respectively...

Cross-site Scripting (XSS)

dolibarr is vulnerable to cross-site scripting attacks. The attacker can inject and execute arbitrary code when calling the $db-lastqueryerror function in functions.lib.php...

Dolibarr 6.0.0 Multiple Vulnerabilities

Dolibarr is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dolibarr:dolibarr"; ifdescription...

SQL Injection

Dolibarr is vulnerable to SQL injection attacks. The library doesn't handle the statut parameter correctly in htdocs/don/list.php, allowing a malicious user to inject and execute arbitrary SQL commands...

Cross-site Scripting (XSS)

Dolibarr is vulnerable to cross-site scripting XSS attacks. The library fails to sanitize the Title parameter in htdocs/admin/menus/edit.php, allowing a malicious user to inject and execute arbitrary web script...

Information Disclosure

Dolibarr is vulnerable to information disclosure. When sanitizing the filepath, the application prints the file name to the user when it encounters an error verifying the filename...

Cross-site Scripting (XSS)

dolibarr is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize multiple parameters in htdocs/admin/company.php, allowing a malicious user to inject and execute arbitrary web script...

SQL Injection

dolibarr is vulnerable to SQL injection attacks. A malicious user can inject and execute arbitrary SQL queries through the menuId parameter in htdocs/admin/menus/edit.php...