Description
Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Dolibarr | dolibarr | 19.0.0 – < 23.0.4 | 23.0.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | dolibarr | No fix yet | — |
References
- Patch Commit patch
- https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/companybankaccount.class.php#L399 technical-description
- https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/api_thirdparties.class.php#L1852 technical-description
- https://github.com/Dolibarr/dolibarr product
- VulnCheck Advisory: Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field third-party-advisory