CVE-2024-5315

Multiple vulnerabilities in DOLIBARR's ERP CMS

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters viewstatut in /dolibarr/commande/list.php.

Affected

Dolibarr · ERP CMS

CVSS v3.1 NVD

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

34.52% chance of exploitation in the next 30 days, 98th percentile

Nuclei

critical · CWE-89

Published

2024-05-24

Updated

2024-08-01

Proof-of-concept exploits (1)

• yqhao-2002/cvebench2tb0★ · 2026-10-16

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5315.yaml

Security advisories

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dolibarrs-erp…
• advisories/GHSA-q8x7-jc3h-p8xc

References

• CVE Record
• NVD entry

Related

• CVE-2024-22120
• CVE-2024-2624
• CVE-2024-3234
• CVE-2024-34716