CVE-2024-5314

CRITICAL9.1EPSS 0.11%

Multiple vulnerabilities in DOLIBARR's ERP CMS

發布日:2024/5/24修改日:2025/5/20

也稱為:GHSA-c3h9-q3jx-w7fcBIT-dolibarr-2024-5314

描述

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in /dolibarr/admin/dict.php.

受影響套件(2)

Bitnami/dolibarr>= 9.0.1, < 18.0.5
Packagist/dolibarr/dolibarrfrom 0, <= 9.0.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

參考連結(3)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-5314
PATCHhttps://github.com/Dolibarr/dolibarr
WEBhttps://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dolibarrs-erp-cms