CVE-2022-4093CWE-89

SQL Injection in dolibarr/dolibarr

High · published November 21, 2022

CVSS v3.0
8.1
EPSS
4%
Percentile
90.9
In the wild
Unconfirmed
What it is

⚡ An SQL injection vulnerability lurks in versions 16.0.1 and 16.0.2, threatening to expose sensitive user data like passwords and credit card info! 🔥 Think of it as a sneaky diner who replaces the menu with a fake one to order anything they want from the kitchen without anyone noticing — it’s all too easy to get what they shouldn't have! If exploited, an attacker could gain unauthorized access to sensitive data, leading to devastating consequences like identity theft and financial fraud. Even worse, they could install a persistent backdoor, allowing them to waltz back in whenever they please, undetected. This could wreak havoc on your reputation and lead to heavy regulatory fines!

Put simply

Think of it as a sneaky diner who replaces the menu with a fake one to order anything they want from the kitchen without anyone noticing — it’s all too easy to get what they shouldn't have! This SQL injection vulnerability allows attackers to manipulate database queries by injecting malicious code in user input fields, bypassing normal access controls and obtaining sensitive data.

What to do

If exploited, an attacker could gain unauthorized access to sensitive data, leading to devastating consequences like identity theft and financial fraud. Even worse, they could install a persistent backdoor, allowing them to waltz back in whenever they please, undetected. This could wreak havoc on your reputation and lead to heavy regulatory fines! Immediately patch your systems to version 16.0.3 or later to close this vulnerability. Ensure that you validate and sanitize all user inputs to bolster your defenses against SQL injection attacks. Regularly audit your codebase and database queries to keep your application secure. You've got this! Follow these steps, and you'll be well on your way to securing your data! 🛡️

The record
Technical detail
CVSS v3.0
8.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04217 · 90.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-11-21T00:00Z
EPSS history
Timeline
  • 21 NOV 00:00Z
    SQL Injection in dolibarr/dolibarr
    cvelistv5