Description

An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statement.

Remediation

References

CVE-2021-36625

Related Vulnerabilities

WordPress Plugin Connections Business Directory CSV Injection (9.6)

WordPress Plugin WP Symposium Arbitrary File Upload Vulnerabilities (11.11.26)

WordPress Plugin Tablesome-Responsive Table, Woocommerce Automation, Email Log, Form Automation-Contact Form 7, Elementor, WPForms, Forminator Cross-Site Request Forgery (1.0.25)

WordPress Plugin Custom Dashboard & Login Page-AGCA Multiple Unspecified Vulnerabilities (1.5.4.2)

Apache Tomcat Permissions, Privileges, and Access Controls Vulnerability (CVE-2009-2901)

Severity

High

Classification

CVE-2021-36625 CWE-138 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities