$ cve CVE-2011-4802 JSON

CVE-2011-4802 EXPLOIT

6.5

MEDIUM · CVSS 2.0 · EPSS 5.5% (pctl 92)

Patch early

A public exploit exists.

Description

Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sortfield, (2) sortorder, and (3) sall parameters to user/index.php and (b) user/group/index.php; the id parameter to (4) info.php, (5) perms.php, (6) param_ihm.php, (7) note.php, and (8) fiche.php in user/; and (9) rowid parameter to admin/boxes.php.

Scoring

CVSS	6.5 (MEDIUM, v2.0)
Vector	AV:N/AC:L/Au:S/C:P/I:P/A:P
EPSS	5.46% — more likely to be exploited than 92% of all CVEs
Weakness	CWE-89
On CISA KEV	no
Public exploit	yes
Published	2011-12-14
Last modified	2026-06-16

Affected (1)

Vendor	Product
dolibarr	dolibarr erp\/crm

Public exploits

Source	Title	Date
exploit-db	Dolibarr ERP/CRM 3.1.0 - '/user/index.php' Multiple SQL Injections	2011-11-23
exploit-db	Dolibarr ERP/CRM 3.1.0 - '/user/info.php?id' SQL Injection	2011-11-23
exploit-db	Dolibarr ERP/CRM 3.1.0 - '/admin/boxes.php?rowid' SQL Injection	2011-11-23

References

→ the Explorer · watch your stack · NVD