Unscored severity · published Feb 21, 2012
CVE-2012-1225
Multiple SQL injection vulnerabilities in Dolibarr CMS 3.2.0 Alpha and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) memberslist parameter…
–
CVSS
2.4%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in Dolibarr CMS 3.2.0 Alpha and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) memberslist parameter (aka Member List) in list.php or (2) rowid parameter to adherents/fiche.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
Dolibarr Erp/crm · Dolibarr
through 3.2.0; 2.5.0; 2.6.0; 2.6.1; 2.7.0; 2.7.1; +7 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-1225
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-1225
Exploit
http://archives.neohapsis.com/archives/bugtraq/2012-02/0056.html
osvdb.org
http://osvdb.org/79011
Vendor Advisory
http://secunia.com/advisories/47969
Exploit
http://www.securityfocus.com/bid/51956
More from Dolibarr Erp/crm
9.8
CVE-2018-25357
Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php
9.8
CVE-2022-4093
SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information
9.8
CVE-2022-43138
Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API
9.8
CVE-2022-40871
Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection
9.8
CVE-2022-0224
dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command