PT-2017-15084 · Dolibarr · Dolibarr Erp/Crm

CVE-2017-17899

·

Publicado

2017-12-24

·

Atualizado

2022-11-17

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM version 6.0.4
Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the rowid parameter in the adherents/subscription/info.php file.
Recommendations For version 6.0.4, consider restricting access to the vulnerable info.php file until a patch is available. As a temporary workaround, avoid using the rowid parameter in the affected API endpoint until the issue is resolved.

Correção

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-17899
GHSA-7789-V767-37R5

Produtos afetados

Dolibarr Erp/Crm