CVE-2012-1225: SQL Injection
First published: Tue Feb 21 2012(Updated: )
Multiple SQL injection vulnerabilities in Dolibarr CMS 3.2.0 Alpha and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) memberslist parameter (aka Member List) in list.php or (2) rowid parameter to adherents/fiche.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dolibarr ERP & CRM | <=3.2.0 | |
| Dolibarr ERP & CRM | =2.5.0 | |
| Dolibarr ERP & CRM | =2.6.0 | |
| Dolibarr ERP & CRM | =2.6.1 | |
| Dolibarr ERP & CRM | =2.7.0 | |
| Dolibarr ERP & CRM | =2.7.1 | |
| Dolibarr ERP & CRM | =2.8.0 | |
| Dolibarr ERP & CRM | =2.8.1 | |
| Dolibarr ERP & CRM | =2.9.0 | |
| Dolibarr ERP & CRM | =3.0.0 | |
| Dolibarr ERP & CRM | =3.0.1 | |
| Dolibarr ERP & CRM | =3.1.0 | |
| Dolibarr ERP & CRM | =3.1.0-rc |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2012-1225?
CVE-2012-1225 is considered to have a high severity due to its potential for remote SQL injection by authenticated users.
How do I fix CVE-2012-1225?
To fix CVE-2012-1225, upgrade to a version of Dolibarr CMS that is higher than 3.2.0 Alpha.
Which versions of Dolibarr CMS are affected by CVE-2012-1225?
CVE-2012-1225 affects Dolibarr CMS versions 3.2.0 Alpha and earlier, as well as specific later versions up to 3.1.0-rc.
Can unauthorized users exploit CVE-2012-1225?
No, CVE-2012-1225 can only be exploited by remote authenticated users.
What types of SQL injection can occur due to CVE-2012-1225?
CVE-2012-1225 allows for arbitrary SQL commands to be executed via the memberslist and rowid parameters.
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/dolibarr
- canonical/dolibarr erp & crm
- version/dolibarr erp & crm/3.2.0
- version/dolibarr erp & crm/2.5.0
- version/dolibarr erp & crm/2.6.0
- version/dolibarr erp & crm/2.6.1
- version/dolibarr erp & crm/2.7.0
- version/dolibarr erp & crm/2.7.1
- version/dolibarr erp & crm/2.8.0
- version/dolibarr erp & crm/2.8.1
- version/dolibarr erp & crm/2.9.0
- version/dolibarr erp & crm/3.0.0
- version/dolibarr erp & crm/3.0.1
- version/dolibarr erp & crm/3.1.0
- version/dolibarr erp & crm/3.1.0-rc