CVE-2019-25450: Dolibarr ERP/CRM 10.0.1 SQL Injection via card.php
Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through POST parameters. Attackers can inject malicious SQL through parameters like actioncode, demandreasonid, and availabilityid in card.php endpoints to extract sensitive database information using boolean-based blind, error-based, and time-based blind techniques.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25450?
CVE-2019-25450 has a medium severity level due to the potential for unauthorized data manipulation.
How do I fix CVE-2019-25450?
To fix CVE-2019-25450, update Dolibarr ERP/CRM to the latest version that addresses SQL injection vulnerabilities.
What types of attacks can CVE-2019-25450 lead to?
CVE-2019-25450 can lead to unauthorized data access and manipulation, potentially exposing sensitive information.
Who is affected by CVE-2019-25450?
Users of Dolibarr ERP/CRM version 10.0.1 are affected by CVE-2019-25450.
How does CVE-2019-25450 work?
CVE-2019-25450 allows attackers to execute arbitrary SQL queries by injecting malicious SQL code through POST parameters in card.php.