This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: A critical SQL Injection (SQLi) flaw in Dolibarr ERP/CRM. ๐ **Consequences**: Attackers can bypass security controls to extract **ALL** data from the database.โฆ
๐ก๏ธ **CWE**: CWE-89 (SQL Injection). ๐ **Flaw**: The `/dolibarr/admin/dict.php` endpoint fails to sanitize the `sortorder` and `sortfield` parameters.โฆ
๐ข **Vendor**: Dolibarr Foundation. ๐ฆ **Product**: Dolibarr ERP/CRM. ๐ **Affected Version**: Specifically **v9.0.1**. ๐ **Scope**: Any instance running this version without patches is vulnerable.
Q4What can hackers do? (Privileges/Data)
๐ต๏ธ **Privileges**: No authentication required (PR:N). ๐๏ธ **Data Access**: High (C:H). Attackers can read **all** stored information. ๐ **Targets**: Products, stock levels, invoices, and customer orders.โฆ
๐ **Threshold**: LOW. ๐ช **Auth**: None required (Publicly exploitable). โ๏ธ **Config**: No special settings needed. ๐ฏ **Vector**: Network-accessible (AV:N). Anyone with internet access to the server can exploit it.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ **PoC**: Not explicitly listed in the provided data (pocs: []). ๐ **Wild Exploit**: Likely exists given the low complexity (AC:L) and lack of auth. ๐ **Ref**: Incibe CERT advisory confirms the vulnerability exists.
Q7How to self-check? (Features/Scanning)
๐ **Check**: Scan for `/dolibarr/admin/dict.php`. ๐งช **Test**: Inject SQL payloads into `sortorder` or `sortfield` parameters. ๐ **Result**: Look for database errors or unexpected data returns in the response.โฆ
๐ง **Workaround**: If patching is delayed, restrict access to `/dolibarr/admin/dict.php` via WAF or firewall rules. ๐ซ **Block**: Prevent direct external access to the admin dictionary endpoint.โฆ