{"id":"CVE-2024-5315","aliases":["BIT-dolibarr-2024-5315","EUVD-2024-1739","GHSA-q8x7-jc3h-p8xc","UBUNTU-CVE-2024-5315"],"status":"published","title":"Multiple vulnerabilities in DOLIBARR's ERP CMS","description":"Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters \n\nviewstatut in /dolibarr/commande/list.php.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.34522,"percentile":0.98429,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2024-05-24T10:06:49Z","modified":"2026-10-28T02:31:07Z","exploits":[{"source":"nuclei","id":"CVE-2024-5315","title":"Dolibarr ERP CMS `list.php` - SQL Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5315.yaml"}],"fixes":[{"ecosystem":"Bitnami","package":"dolibarr","fixed_in":["18.0.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"dolibarr/dolibarr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"9.0.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"dolibarr","ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.1"},{"fixed":"18.0.5"}]}]},{"source":"osv","ecosystem":"Packagist","package":"dolibarr/dolibarr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"9.0.1"}]}],"versions":["3.6.0","3.6.0-beta","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.7.0","3.7.1","3.7.2","3.7.3","3.7.4","3.8.0","3.8.0-beta","3.8.1","3.8.2","3.8.3","3.8.4","3.9.0","3.9.0-rc","3.9.0-rc2","3.9.1","3.9.2","3.9.3","3.9.4","4.0.0","4.0.0-beta","4.0.0-rc","4.0.0-rc2","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","5.0.0","5.0.0-beta","5.0.0-rc1","5.0.0-rc2","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","6.0.0","6.0.0-beta","6.0.0-rc","6.0.1","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.0.8","7.0.0","7.0.1","7.0.2","7.0.3","7.0.4","7.0.5","8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","9.0.0","9.0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dolibarr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.5+dfsg1-2","3.5.7+dfsg1-1","3.5.8+dfsg1-1","3.5.8+dfsg1-1ubuntu1","3.5.8+dfsg1-1ubuntu1+esm1"]}],"products":[{"vendor":"dolibarr","product":"dolibarr"},{"vendor":"dolibarr","product":"dolibarr_erp\\/crm"},{"vendor":"dolibarr","product":"erp cms"}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dolibarrs-erp-cms","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5315","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-q8x7-jc3h-p8xc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5315.json","tags":["advisory"]},{"url":"https://github.com/Dolibarr/dolibarr","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-5315","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-5315","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-5315","title":"Multiple vulnerabilities in DOLIBARR's ERP CMS","description":"Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters \n\nviewstatut in /dolibarr/commande/list.php.","status":"published","published":"2024-05-24T10:06:49.112Z","modified":"2024-08-01T21:11:12.371Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:01.286506Z"}],"euvd":[{"id":"EUVD-2024-1739","description":"Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters \n\nviewstatut in /dolibarr/commande/list.php.","status":"published","published":"2024-05-24T10:06:49Z","modified":"2024-08-01T21:11:12Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T03:50:34.650065Z"}],"ghsa":[{"id":"GHSA-q8x7-jc3h-p8xc","title":"Dolibarr vulnerable to SQL Injection","description":"Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters in /dolibarr/commande/list.php.","status":"published","published":"2024-05-24T14:53:44Z","modified":"2024-05-24T14:53:46Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:51.549437Z"}],"nvd":[{"id":"CVE-2024-5315","description":"Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters \n\nviewstatut in /dolibarr/commande/list.php.","status":"published","published":"2024-05-24T10:15:11.197Z","modified":"2026-06-17T08:15:41.24Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:10:02.520903Z"}],"osv":[{"id":"CVE-2024-5315","title":"Multiple vulnerabilities in DOLIBARR's ERP CMS","description":"Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters \n\nviewstatut in /dolibarr/commande/list.php.","status":"published","published":"2024-05-24T10:06:49.112Z","modified":"2026-10-28T02:31:07.444250411Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:44:44.451316Z"},{"id":"GHSA-q8x7-jc3h-p8xc","title":"Dolibarr vulnerable to SQL Injection","description":"Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters in /dolibarr/commande/list.php.","status":"published","published":"2024-05-24T14:53:44Z","modified":"2025-04-10T23:17:40.829671Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"UBUNTU-CVE-2024-5315","description":"Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters viewstatut in /dolibarr/commande/list.php.","status":"published","published":"2024-05-24T10:15:00Z","modified":"2026-06-17T20:15:27.414441773Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:55:11.182485Z"},{"id":"BIT-dolibarr-2024-5315","title":"Multiple vulnerabilities in DOLIBARR's ERP CMS","description":"Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters \n\nviewstatut in /dolibarr/commande/list.php.","status":"published","published":"2025-04-03T14:07:13.49Z","modified":"2025-05-20T10:02:07.006Z","updated_at":"2026-11-02T15:28:29.152062Z"}]}}