CVE-2011-4802

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-12-14 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sortfield, (2) sortorder, and (3) sall parameters to user/index.php and (b) user/group/index.php; the id parameter to (4) info.php, (5) perms.php, (6) param_ihm.php, (7) note.php, and (8) fiche.php in user/; and (9) rowid parameter to admin/boxes.php.

Affected products

dolibarr: through 3.1.0; 2.5.0, 2.6.0, 2.6.1, 2.7.0, 2.7.1, 2.8.0 (+4)

References

http://osvdb.org/77340
http://osvdb.org/77341
http://osvdb.org/77342
http://osvdb.org/77343
http://osvdb.org/77344
http://osvdb.org/77345
http://osvdb.org/77346
http://osvdb.org/77347
http://www.securityfocus.com/archive/1/520619/100/0/threaded
http://www.securityfocus.com/bid/50777
https://github.com/Dolibarr/dolibarr/commit/63820ab37537fdff842539425b2bf2881f0d8e91
https://github.com/Dolibarr/dolibarr/commit/762f98ab4137749d0993612b4e3544a4207e78a1

Get alerted when CVE-2011-4802 or the next vulnerability affects your stack