by Kastro
Paper/Archive/CVE-2019-25710

CVE-2019-25710

Dolibarr Dolibarr ERP-CRM — Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
32
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 23.9.239 × 204.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary SQL queries. Attackers can inject malicious SQL code through the rowid POST parameter to extract sensitive database information using error-based SQL injection techniques.

Affected

ProductAffectedFixed inSource
Dolibarr ERP-CRM8.0.4–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
VulnCheck (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

exploitexploit-db.com/exploits/46095refdolibarr.orgrefsourceforge.net/projects/dolibarr/files/Dolibarr%20ERP-CRM/8.0.4/dolibarr-8.0.4.zipwriteupvulncheck.com/advisories/dolibarr-erp-crm-sql-injection-via-rowid-parameter