Unscored severity · published Dec 14, 2011
CVE-2011-4802
Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sortfield, (2)…
–
CVSS
5.5%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sortfield, (2) sortorder, and (3) sall parameters to user/index.php and (b) user/group/index.php; the id parameter to (4) info.php, (5) perms.php, (6) param_ihm.php, (7) note.php, and (8) fiche.php in user/; and (9) rowid parameter to admin/boxes.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.5% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
Dolibarr Erp/crm · Dolibarr
through 3.1.0; 2.5.0; 2.6.0; 2.6.1; 2.7.0; 2.7.1; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4802
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4802
Broken Link
http://osvdb.org/77340
Broken Link
http://osvdb.org/77341
Broken Link
http://osvdb.org/77342
Broken Link
http://osvdb.org/77343
Broken Link
http://osvdb.org/77344
Broken Link
http://osvdb.org/77345
More from Dolibarr Erp/crm
9.8
CVE-2018-25357
Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php
9.8
CVE-2022-4093
SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information
9.8
CVE-2022-43138
Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API
9.8
CVE-2022-40871
Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection
9.8
CVE-2022-0224
dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command