Critical · published May 24, 2024
🚨 A crafty SQL injection vulnerability is hiding in Dolibarr ERP - CRM, and it’s ready to spill all your secrets! 🔥 Think of it like giving a waiter a seemingly harmless order to fetch a specific meal, but they end up bringing you the entire menu instead — all the database contents at their fingertips! An attacker could send a specially crafted SQL query to the system, allowing them to retrieve all the sensitive information stored in the database. This could lead to exposure of customer data, business strategies, or even financial records, making this vulnerability absolutely devastating for any organization.
Think of it like giving a waiter a seemingly harmless order to fetch a specific meal, but they end up bringing you the entire menu instead — all the database contents at their fingertips! The SQL injection vulnerabilities affect Dolibarr version 9.0.1 by allowing an attacker to exploit the parameters 'sortorder' and 'sortfield' in /dolibarr/admin/dict.php to manipulate SQL queries and extract data.
An attacker could send a specially crafted SQL query to the system, allowing them to retrieve all the sensitive information stored in the database. This could lead to exposure of customer data, business strategies, or even financial records, making this vulnerability absolutely devastating for any organization. Immediately patch your Dolibarr installation to version 9.0.2 or later to close this vulnerability. Review your database permissions and ensure that you have input validation in place to mitigate any such attacks in the future. You've got this! Follow these steps to secure your system and protect your valuable data! 🛡️