CVE-2014-7137: SQL Injection
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) projectref parameter to projet/tasks/contact.php; (4) lineid parameter in a deletecontact action, (5) ligne parameter in a swapstatut action, or (6) ref parameter to projet/contact.php; (7) id parameter to compta/bank/fiche.php, (8) contact/info.php, (9) holiday/index.php, (10) product/stock/fiche.php, (11) product/stock/info.php, or (12) in an edit action to product/stock/fiche.php; (13) productid parameter in an addline action to product/stock/massstockmove.php; (14) projectref parameter to projet/tasks/note.php; (15) ref parameter to element.php, (16) ganttview.php, (17) note.php, or (18) tasks.php in projet/; (19) sall or (20) sref parameter to comm/mailing/liste.php; (21) searchbon, (22) searchligne, (23) searchsociete, or (24) searchcode parameter to compta/prelevement/liste.php; (25) searchlabel parameter to compta/sociales/index.php; (26) searchproject parameter to projet/tasks/index.php; (27) searchsociete parameter to compta/prelevement/demandes.php; (28) searchstatut parameter to user/index.php; (29) socid parameter to compta/recap-compta.php, (30) societe/commerciaux.php, or (31) societe/rib.php; (32) sortorder, (33) sref, (34) sall, or (35) sortfield parameter to product/stock/liste.php; (36) statut parameter to adherents/liste.php or (37) compta/dons/liste.php; (38) tobuy or (39) tosell parameter to product/liste.php; (40) tobuy, (41) tosell, (42) searchcateg, or (43) sref parameter to product/reassort.php; (44) type parameter to product/index.php; or the (a) sortorder or (b) sortfield parameter to (45) compta/paiement/cheque/liste.php, (46) compta/prelevement/bons.php, (47) compta/prelevement/rejets.php, (48) product/stats/commande.php, (49) product/stats/commandefournisseur.php, (50) product/stats/contrat.php, (51) product/stats/facture.php, (52) product/stats/facturefournisseur.php, (53) product/stats/propal.php, or (54) product/stock/replenishorders.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7137?
CVE-2014-7137 has a medium severity rating due to its potential impact on database integrity.
How do I fix CVE-2014-7137?
To fix CVE-2014-7137, upgrade Dolibarr ERP/CRM to version 3.6.1 or later.
What systems are affected by CVE-2014-7137?
CVE-2014-7137 affects Dolibarr ERP/CRM versions prior to 3.6.1.
What type of vulnerability is CVE-2014-7137?
CVE-2014-7137 is classified as an SQL injection vulnerability.
Can CVE-2014-7137 be exploited remotely?
Yes, CVE-2014-7137 can be exploited by remote authenticated users to execute arbitrary SQL commands.