CVE-2012-1225: SQL Injection
Multiple SQL injection vulnerabilities in Dolibarr CMS 3.2.0 Alpha and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) memberslist parameter (aka Member List) in list.php or (2) rowid parameter to adherents/fiche.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1225?
CVE-2012-1225 is considered to have a high severity due to its potential for remote SQL injection by authenticated users.
How do I fix CVE-2012-1225?
To fix CVE-2012-1225, upgrade to a version of Dolibarr CMS that is higher than 3.2.0 Alpha.
Which versions of Dolibarr CMS are affected by CVE-2012-1225?
CVE-2012-1225 affects Dolibarr CMS versions 3.2.0 Alpha and earlier, as well as specific later versions up to 3.1.0-rc.
Can unauthorized users exploit CVE-2012-1225?
No, CVE-2012-1225 can only be exploited by remote authenticated users.
What types of SQL injection can occur due to CVE-2012-1225?
CVE-2012-1225 allows for arbitrary SQL commands to be executed via the memberslist and rowid parameters.