GHSA-xxxg-x793-7fq3

Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php

Source: GitHub Advisory Database (reviewed) High CVE-2019-25710

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	dolibarr/dolibarr	<= 8.0.4	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary SQL queries. Attackers can inject malicious SQL code through the rowid POST parameter to extract sensitive database information using error-based SQL injection techniques.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-25710 advisory
https://github.com/Dolibarr/dolibarr package
https://sourceforge.net/projects/dolibarr/files/Dolibarr%20ERP-CRM/8.0.4/dolibarr-8.0.4.zip web
https://www.dolibarr.org web
https://www.exploit-db.com/exploits/46095 web
https://www.vulncheck.com/advisories/dolibarr-erp-crm-sql-injection-via-rowid-parameter web