CVE-2020-14443: SQL Injection

Q: What is CVE-2020-14443?

CVE-2020-14443 is a SQL injection vulnerability in Dolibarr 11.0.3.

Q: How does CVE-2020-14443 impact Dolibarr?

CVE-2020-14443 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.

Q: What is the severity of CVE-2020-14443?

CVE-2020-14443 has a severity score of 8.8 (high).

Q: How can I fix the SQL injection vulnerability in Dolibarr 11.0.3?

To fix the SQL injection vulnerability, update Dolibarr to a version which includes the fix, such as the commit 40e16672e3aa4e9208ea7a4829f30507dcdfc4ba.

Q: What is CWE-89?

CWE-89 is a weakness in software that allows an attacker to inject malicious SQL statements.

Published Jun 18, 2020

Updated

A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.

Other sources

A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.4 and below allows remote authenticated users to execute arbitrary SQL commands via the id parameter.

— GitHub

Affected Software

2 affected componentsFixes available

composer/dolibarr/dolibarr<11.0.5

11.0.5

dolibarr Dolibarr<=11.0.3

Remediation

Patch Available

https://github.com/Dolibarr/dolibarr/commit/40e16672e3aa4e9208ea7a4829f30507dcdfc4ba

Event History

Jun 18, 2020

CVE Published

via MITRE·05:26 PM

Data Sourced

via MITRE·05:26 PM

Description

May 24, 2022

Advisory Published

via GitHub·05:20 PM

Frequently Asked Questions

What is CVE-2020-14443?

CVE-2020-14443 is a SQL injection vulnerability in Dolibarr 11.0.3.

How does CVE-2020-14443 impact Dolibarr?

CVE-2020-14443 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.

What is the severity of CVE-2020-14443?