CVE-2021-36625

HIGH8.8EPSS 0.28%

SQL Injection in Dolibarr

Published: 4/1/2022Modified: 4/3/2025

Also known as:GHSA-vrgp-3ph6-2wwqBIT-dolibarr-2021-36625

Description

An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statement.

Affected packages (2)

Bitnami/dolibarr>= 13.0.2, <= 13.0.2
Packagist/dolibarr/dolibarrfrom 0, < 14.0.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References (3)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-36625
PATCHhttps://github.com/Dolibarr/dolibarr
WEBhttps://github.com/Dolibarr/dolibarr/commit/abb1ad6bf0469eccd2b58beb20bdabc18fc36e22