CVE-2011-4802

Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sortfield, (2) sortorder, and (3) sall parameters to user/index.php and (b) user/group/index.php; the id parameter to (4) info.php, (5) perms.php, (6) param_ihm.php, (7) note.php, and (8) fiche.php in user/; and (9) rowid parameter to admin/boxes.php.

CVSS v2.0 NVD

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

5.46% chance of exploitation in the next 30 days, 93rd percentile

Published

2011-12-14

Updated

2024-08-07

ExploitDB entries (3)

• https://www.exploit-db.com/exploits/36333
• https://www.exploit-db.com/exploits/36332
• https://www.exploit-db.com/exploits/36331

Security advisories

• http://www.securityfocus.com/archive/1/520619/100/0/threaded
• http://www.securityfocus.com/bid/50777
• Dolibarr/dolibarr/commit/63820ab37537fdff842539425b2bf2881f0d8e91

References

• CVE Record
• NVD entry