CVE-2018-10094 Dolibarr SQL injection vulnerability

Critical 9.8 Published 22 May 2018 Updated 5 Aug 2024

Remote attackers can execute arbitrary SQL commands in Dolibarr via unquoted integer parameters, potentially compromising database integrity and confidentiality.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-10094?

CVE-2018-10094 is a critical SQL injection vulnerability in n/a, published on 22 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.

Weakness: CWE-89

Which versions are affected by CVE-2018-10094?

2 open source packages ship an affected version, including dolibarr/dolibarr. It affects 1 product.

Package	Affected	Fixed in
`dolibarr/dolibarr` Packagist	All versions	`7.0.2`
`dolibarr/dolibarr` Packagist	All versions	`7.0.2`

Products include Dolibarr Dolibarr.

How do I fix CVE-2018-10094?

Upgrade dolibarr/dolibarr to 7.0.2 or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2018-10094 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-10094 exists.

Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.

Sources

Also known as GHSA-57wj-22w9-wm9r, UBUNTU-CVE-2018-10094.