Description

An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and value_unit.

Remediation

References

CVE-2018-16809

Related Vulnerabilities

MySQL Other Vulnerability (CVE-2004-0956)

WordPress Other Vulnerability (CVE-2005-1810)

WordPress Plugin Polo Video Gallery-Best wordpress video gallery Cross-Site Scripting (1.2)

WordPress Plugin LifterLMS-WP LMS for eLearning, Online Courses, & Quizzes Security Bypass (3.34.5)

WordPress Plugin SpamBam Key Calculation Security Bypass (2.1)

Severity

Critical

Classification

CVE-2018-16809 CWE-138 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities