Cloudanix VulnDB

CVE-2024-5314

Critical · 9.1

CVSS

9.1

EPSS

0.6%

Published

May 24, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in this business management software lets outsiders steal every piece of information stored in the company's database without logging in.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
Application
Class
SQL Injection
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

Remote unauthenticated SQL injection via sortorder and sortfield parameters in /dolibarr/admin/dict.php allows arbitrary query execution and full database contents extraction.

Why it matters to the business

Attackers can obtain all stored business records including customer, financial, and operational data, resulting in data breaches, regulatory penalties, and loss of competitive information.

How an attack unfolds

An attacker crafts HTTP GET requests to the dictionary administration endpoint, embedding SQL metacharacters and clauses into the sortorder or sortfield parameters to modify the backend query and retrieve arbitrary table contents.

How to fix it

Upgrade Dolibarr to a patched release that sanitizes or parameterizes the sortorder and sortfield inputs in the dictionary module; restrict administrative endpoints to authenticated users and apply web application firewall rules that block common SQL metacharacters.

How to confirm the fix worked

Confirm the vulnerable endpoint no longer accepts SQL syntax in the named parameters by replaying test payloads and reviewing application source for prepared-statement usage around those variables.

Typical attack path

  1. Locate an exposed Dolibarr installation and the dict.php admin endpoint
  2. Test parameter handling with simple SQL syntax in sortorder or sortfield
  3. Inject payload that alters the SELECT statement to dump sensitive tables
  4. Exfiltrate database rows through the application's response or error messages

How to detect it

Inspect web server access logs for requests to /dolibarr/admin/dict.php containing SQL keywords, UNION clauses, or anomalous values in the sortorder and sortfield query parameters.

  • /dolibarr/admin/dict.php?sortorder=
  • /dolibarr/admin/dict.php?sortfield=
  • sortorder=1%20UNION
  • sortfield=1%20SELECT

What your security team should do

  • Block or restrict access to /dolibarr/admin/dict.php from untrusted networks
  • Deploy WAF signatures targeting SQL injection in sort parameters
  • Audit logs for historical exploitation attempts against the endpoint
  • Review all similar administrative pages for unsanitized ORDER BY or sort inputs

The record

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in /dolibarr/admin/dict.php.

Affected packages

Ecosystem Package Introduced Fixed
Packagist dolibarr/dolibarr 0 No fix
Bitnami dolibarr 9.0.1 18.0.5
Ubuntu:16.04:LTS dolibarr 0 No fix
Ubuntu:Pro:16.04:LTS dolibarr 0 No fix

Related vulnerabilities