GHSA-57wj-22w9-wm9r

Dolibarr SQL injection vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-10094

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	dolibarr/dolibarr	< 7.0.2	7.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-10094 advisory
https://github.com/Dolibarr/dolibarr/commit/7ade4e37f24d6859987bb9f6232f604325633fdd web
https://github.com/Dolibarr/dolibarr package
https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog web
https://sysdream.com/news/lab/2018-05-21-cve-2018-10094-dolibarr-sql-injection-vulnerability web
https://www.exploit-db.com/exploits/44805 web
http://www.openwall.com/lists/oss-security/2018/05/21/1 web