CVE-2022-4093 - SQL Injection in dolibarr/dolibarr

Back Back to CVE browser

CRITICAL

SQL Injection in dolibarr/dolibarr

Published Nov 21, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 4.22%

Description

SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization's systems, leading to a long-term compromise that can go unnoticed for an extended period. This affect 16.0.1 and 16.0.2 only. 16.0.0 or lower, and 16.0.3 or higher are not affected

Affected products

Vendor Dolibarr Product Dolibarr/dolibarr Default
unknown
Affected
- ≥ unspecified, < 16.0.3

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Dolibarr	Dolibarr/dolibarr	unknown	Affected ≥ unspecified, < 16.0.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7348
Advisory
https://github.com/advisories/GHSA-gjg7-qfvp-9hm4
Advisory
https://github.com/dolibarr/dolibarr/commit/7c1eac9774bd1fed0b7b4594159f2ac2d12a4011
PatchThird Party Advisory
https://huntr.dev/bounties/677ca8ee-ffbc-4b39-b294-2ce81bd56788
ExploitIssue TrackingPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-4093

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7348		Advisory
https://github.com/advisories/GHSA-gjg7-qfvp-9hm4		Advisory
https://github.com/dolibarr/dolibarr/commit/7c1eac9774bd1fed0b7b4594159f2ac2d12a4011		PatchThird Party Advisory
https://huntr.dev/bounties/677ca8ee-ffbc-4b39-b294-2ce81bd56788		ExploitIssue TrackingPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-4093