Multiple vulnerabilities in DOLIBARR's ERP CMS

Vulnerability

Overview

CVE-2024-5314 is a critical SQL injection vulnerability in Dolibarr ERP-CRM version 9.0.1. The flaw resides in the /dolibarr/admin/dict.php script, where the sortorder and sortfield parameters are not properly sanitized before being used in SQL queries. This allows an attacker to inject arbitrary SQL commands [1][2][3].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable endpoint. No prior authentication or special network position is required, making the attack surface broad. The parameters sortorder and sortfield are directly concatenated into SQL statements, enabling the attacker to manipulate the query logic [2][3].

Impact

Successful exploitation allows the attacker to retrieve all information stored in the database, including sensitive data such as user credentials, financial records, and business information. The CVSS v3.1 base score is 9.1 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating high confidentiality and integrity impact but no availability impact [3].

Mitigation

As of the advisory publication, no official patch or workaround has been released for this vulnerability. Users of Dolibarr ERP-CRM 9.0.1 are advised to restrict network access to the affected endpoint and monitor for updates from the vendor [3].