PT-2017-15084 · Dolibarr · Dolibarr Erp/Crm

CVE-2017-17899

·

Published

2017-12-24

·

Updated

2022-11-17

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM version 6.0.4
Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the rowid parameter in the adherents/subscription/info.php file.
Recommendations For version 6.0.4, consider restricting access to the vulnerable info.php file until a patch is available. As a temporary workaround, avoid using the rowid parameter in the affected API endpoint until the issue is resolved.

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-17899
GHSA-7789-V767-37R5

Affected Products

Dolibarr Erp/Crm