Dolibarr SQL injection vulnerability

CRITICAL 9.8CVE-2018-10094 · GHSA-57wj-22w9-wm9r · Published 22/05/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
dolibarr/dolibarr Packagist	`< 7.0.2`	`7.0.2`
dolibarr dolibarr	`< 7.0.2`	`7.0.2`

Description

SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.

NVD description

SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.

References

nvd.nist.gov/vuln/detail/CVE-2018-10094 · ADVISORY
Dolibarr/dolibarr commit 7ade4e3 · WEB
Dolibarr/dolibarr · PACKAGE
Dolibarr/dolibarr · WEB
sysdream.com/news/lab/2018-05-21-cve-2018-10094-dolibarr-sql-injection-vulnerability · WEB
exploit-db.com/exploits/44805 · WEB
openwall.com/lists/oss-security/2018/05/21/1 · WEB
sysdream.com/news/lab/2018-05-21-cve-2018-10094-dolibarr-sql-injection-vulnerability · Exploit
exploit-db.com/exploits/44805 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free