Dolibarr ERP/CMS 3.4.0 (exportcsv.php, sondage param) - SQL Injection

Exploit for php platform in category web applications Exploit Title: Dolibarr 3.4.0 SQLi Date: 10/7/2013 Exploit author: drone @dronesec More information: http://forelsec.blogspot.com/2013/10/dolibarr-340-multiple-vulnerabilities.html Vendor homepage: http://www.dolibarr.org/ Software link:...

Dolibarr ERPCRM 3.4.0 - exportcsv.php?sondage SQL Injection

Dolibarr ERPCRM 3.4.0 - exportcsv.php?sondage SQL Injection Exploit Title: Dolibarr 3.4.0 SQLi Date: 10/7/2013 Exploit author: drone @dronesec More information: http://forelsec.blogspot.com/2013/10/dolibarr-340-multiple-vulnerabilities.html Vendor homepage: http://www.dolibarr.org/ Software link:...

Dolibarr 3.2.2 Cross Site Scripting / SQL Injection

HTTPCS Advisory : HTTPCS94 Product : Dolibarr Version : 3.2.2 Date : 2012-10-19 Criticality level : Highly Critical Description : A vulnerability has been discovered in Dolibarr, which can be exploited by malicious people to conduct SQL injection attacks. Input passed via the 'rights' parameter t...

Dolibarr 3.0.0 LFI

Local file include vulnerability in Dolibarr Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...

Dolibarr 3.1.0 admin/company.php username Parameter XSS

The version of Dolibarr on the remote host fails to properly sanitize parameters in 'admin/company.php' before using them to generate dynamic HTML. By tricking someone into clicking on a specially crafted link, an attacker may be able exploit this issue to inject arbitrary HTML and script code in...

Dolibarr passwordforgotten.php theme Parameter Local File Inclusion

The version of Dolibarr installed on the remote host fails to sanitize user-supplied input to the 'theme' parameter of the 'user/passwordforgotten.php' script before using it to include PHP code. Using a specially crafted request, a remote, unauthenticated attacker may be able to leverage this...

Dolibarr Multiple Script URI XSS

The version of Dolibarr on the remote host fails to properly sanitize parameters in 'index.php' before using them to generate dynamic HTML. By tricking someone into clicking on a specially crafted link, an attacker may be able exploit this issue to inject arbitrary HTML and script code in a user'...

Dolibarr Detection

The remote host is running Dolibarr, an ERP and CRM software product written in PHP and with a MySQL back-end. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid58745; scriptversion"1.7"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01";...

Dolibarr ERP & CRM 3 Post-Auth OS Command Injection

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "Dolibarr ERP & CR...

Dolibarr ERP & CRM 3 Post-Auth OS Command Injection

Exploit for php platform in category web applications This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

Dolibarr ERPCRM 3.2.0 3.1.1 - OS Command Injection

Dolibarr ERPCRM 3.2.0 3.1.1 - OS Command Injection Dolibarr ERP & CRM OS Command Injection =================================== 1. Advisory Information Date published: 2012-4-6 Vendors contacted: Dolibarr Release mode: Coordinated release 2. Vulnerability Information Class: Injection Remotely...

Dolibarr ERP & CRM OS Command Injection

Exploit for php platform in category web applications Dolibarr ERP & CRM OS Command Injection =================================== 1. Advisory Information Date published: 2012-4-6 Vendors contacted: Dolibarr Release mode: Coordinated release 2. Vulnerability Information Class: Injection Remotely...

Dolibarr ERP/CRM < 3.2.0 / < 3.1.1 - OS Command Injection

Dolibarr ERP & CRM OS Command Injection =================================== 1. Advisory Information Date published: 2012-4-6 Vendors contacted: Dolibarr Release mode: Coordinated release 2. Vulnerability Information Class: Injection Remotely Exploitable: Yes Locally Exploitable: Yes 3. Software...

Dolibarr ERP/CRM 3 - (Authenticated) OS Command Injection (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "Dolibarr ERP & CR...

Dolibarr ERP/CRM Login Utility

This module attempts to authenticate to a Dolibarr ERP/CRM's admin web interface, and should only work against version 3.1.1 or older, because these versions do not have any default protections against brute forcing. This module requires Metasploit: https://metasploit.com/download Current source:...

Dolibarr ERP / CRM OS Command Injection

Dolibarr ERP & CRM OS Command Injection =================================== 1. Advisory Information Date published: 2012-4-6 Vendors contacted: Dolibarr Release mode: Coordinated release 2. Vulnerability Information Class: Injection Remotely Exploitable: Yes Locally Exploitable: Yes 3. Software...

Dolibarr ERP/CRM Post-Auth OS Command Injection

This module exploits a vulnerability found in Dolibarr ERP/CRM 3's backup feature. This software is used to manage a company's business information such as contacts, invoices, orders, stocks, agenda, etc. When processing a database backup request, the export.php function does not check the input...

Dolibarr ERPCRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities

Dolibarr ERPCRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities source: https://www.securityfocus.com/bid/52113/info Dolibarr is prone to multiple directory-traversal vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting the issues can allow an attacke...

Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities

source: https://www.securityfocus.com/bid/52113/info Dolibarr is prone to multiple directory-traversal vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting the issues can allow an attacker to obtain sensitive information that could aid in further attacks...

CVE-2012-1225

Multiple SQL injection vulnerabilities in Dolibarr CMS 3.2.0 Alpha and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 memberslist parameter aka Member List in list.php or 2 rowid parameter to adherents/fiche.php...