CVE-2011-4802

Published: Dec 14, 2011Modified: Apr 29, 2026

6.5

Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability: 8.0 / Impact: 6.4

Source: NVD

Description

Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sortfield, (2) sortorder, and (3) sall parameters to user/index.php and (b) user/group/index.php; the id parameter to (4) info.php, (5) perms.php, (6) param_ihm.php, (7) note.php, and (8) fiche.php in user/; and (9) rowid parameter to admin/boxes.php.

Affected (11)

Products: Dolibarr: Dolibarr Erp/crm

1 product

Dolibarr Erp/crm

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Dolibarr Dolibarr Erp/crm	Up to 3.1.0
Dolibarr Dolibarr Erp/crm	Version 2.5.0
Dolibarr Dolibarr Erp/crm	Version 2.6.0
Dolibarr Dolibarr Erp/crm	Version 2.6.1
Dolibarr Dolibarr Erp/crm	Version 2.7.0
Dolibarr Dolibarr Erp/crm	Version 2.7.1
Dolibarr Dolibarr Erp/crm	Version 2.8.0
Dolibarr Dolibarr Erp/crm	Version 2.8.1
Dolibarr Dolibarr Erp/crm	Version 2.9.0
Dolibarr Dolibarr Erp/crm	Version 3.0.0
Dolibarr Dolibarr Erp/crm	Version 3.0.1

Related CWEs

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (30)

http://osvdb.org/77340

Source: cve@mitre.org

Broken Link

http://osvdb.org/77341

Source: cve@mitre.org

Broken Link

http://osvdb.org/77342

Source: cve@mitre.org

Broken Link

http://osvdb.org/77343

Source: cve@mitre.org

Broken Link

http://osvdb.org/77344

Source: cve@mitre.org

Broken Link

http://osvdb.org/77345

Source: cve@mitre.org

Broken Link

http://osvdb.org/77346

Source: cve@mitre.org

Broken LinkExploit

http://osvdb.org/77347

Source: cve@mitre.org

Broken LinkExploit

http://www.securityfocus.com/archive/1/520619/100/0/threaded

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/50777

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

https://github.com/Dolibarr/dolibarr/commit/63820ab37537fdff842539425b2bf2881f0d8e91

Source: cve@mitre.org

ExploitPatch

https://github.com/Dolibarr/dolibarr/commit/762f98ab4137749d0993612b4e3544a4207e78a1

Source: cve@mitre.org

ExploitPatch

https://github.com/Dolibarr/dolibarr/commit/c539155d6ac2f5b6ea75b87a16f298c0090e535a

Source: cve@mitre.org

ExploitPatch

https://github.com/Dolibarr/dolibarr/commit/d08d28c0cda1f762a47cc205d4363de03df16675

Source: cve@mitre.org

ExploitPatch

https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_dolibarr.html

Source: cve@mitre.org

Exploit

http://osvdb.org/77340

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://osvdb.org/77341

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://osvdb.org/77342

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://osvdb.org/77343

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://osvdb.org/77344

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://osvdb.org/77345

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://osvdb.org/77346

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkExploit

http://osvdb.org/77347

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkExploit

http://www.securityfocus.com/archive/1/520619/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/50777

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://github.com/Dolibarr/dolibarr/commit/63820ab37537fdff842539425b2bf2881f0d8e91

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

https://github.com/Dolibarr/dolibarr/commit/762f98ab4137749d0993612b4e3544a4207e78a1

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

https://github.com/Dolibarr/dolibarr/commit/c539155d6ac2f5b6ea75b87a16f298c0090e535a

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

https://github.com/Dolibarr/dolibarr/commit/d08d28c0cda1f762a47cc205d4363de03df16675

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_dolibarr.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.