Multiple vulnerabilities in DOLIBARR's ERP CMS

Root

Cause CVE-2024-5315 is an SQL injection vulnerability in Dolibarr ERP-CRM version 9.0.1 [1]. The flaw exists in the /dolibarr/commande/list.php endpoint, where the viewstatut parameter is not properly sanitized before being used in a database query [2]. This allows an attacker to inject arbitrary SQL commands [3].

Exploitation

The vulnerability is exploitable remotely without any prior authentication [3]. An attacker only needs to send a crafted HTTP request containing malicious SQL in the viewstatut parameter to the vulnerable endpoint [2]. No special privileges or network access restrictions are required beyond reachability of the web application [3].

Impact

Successful exploitation enables an attacker to read, modify, or delete arbitrary data from the underlying database [2]. This can lead to complete disclosure of all information stored in the database, including sensitive business data, user credentials, and financial records [3]. The CVSS v3.1 base score is 9.1, indicating critical severity due to high impact on confidentiality and integrity [3].

Mitigation

As of the publication date (2024-05-24), no official patch or mitigation has been released for this vulnerability [3]. Users of Dolibarr 9.0.1 are advised to monitor the vendor's repository for updates or apply input validation and prepared statements as a workaround [1][3].