SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categories_list.php, /accountancy/admin/journals_list.php, /admin/dict.php, /admin/mails_templates.php, or /admin/website.php.
References
Link | Resource |
---|---|
https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog | Release Notes |
https://github.com/Dolibarr/dolibarr/commit/83b762b681c6dfdceb809d26ce95f3667b614739 | Patch |
https://www.oracle.com/security-alerts/cpujan2021.html | Third Party Advisory |
Configurations
History
30 Jan 2021, 02:36
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:oracle:data_integrator:11.1.1.9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:* |
|
References | (MISC) https://www.oracle.com/security-alerts/cpujan2021.html - Third Party Advisory |
20 Jan 2021, 15:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
Information
Published : 2018-05-22 20:29
Updated : 2023-12-10 12:30
NVD link : CVE-2018-9019
Mitre link : CVE-2018-9019
CVE.ORG link : CVE-2018-9019
JSON object : View
Products Affected
oracle
- data_integrator
dolibarr
- dolibarr
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')