Dolibarr Multiple Vulnerabilities


Description   (#Several vulnerabilities were reported in Dolibarr:#- CVE-2017-17897: SQL injection in the "comm/multiprix.php" file triggerable via the "id" parameter#- CVE-2017-17898: information disclosure due to non-blocking request to "*.tpl.php" files#- CVE-2017-17899: SQL injection in the "adherents/subscription/info.php" file triggerable via the "rowid" parameter#- CVE-2017-17900: SQL injection in the "fourn/index.php" file triggerable via the "socid" parameter.##Updated, 26/12/2017:#The dolibarr packages provided by Debian Jessie 8 and Stretch 9 are vulnerable.)
     
Vulnerable Products   Vulnerable OS:
GNU/Linux (Debian) - 8, 9
     
Solution   Patchs are available on the Git repository.
     
CVE   CVE-2017-17900
CVE-2017-17899
CVE-2017-17898
CVE-2017-17897
     
References   - Dolibarr : FIX security vulnerability reported by ADLab of Venustech
https://github.com/Dolibarr/dolibarr/commit/6a62e139604dbbd5729e57df2433b37a5950c35c
- Dolibarr : FIX security vulnerability reported by ADLab of Venustech
https://github.com/Dolibarr/dolibarr/commit/4a5988accbb770b74105baacd5a034689272128c
- Debian Security Tracker : dolibarr
https://security-tracker.debian.org/tracker/CVE-2017-17897
https://security-tracker.debian.org/tracker/CVE-2017-17898
https://security-tracker.debian.org/tracker/CVE-2017-17899
https://security-tracker.debian.org/tracker/CVE-2017-17900
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
SQL injection Prevention - GET : suspicious OR statement in URL
3.2.0
SQL injection Prevention - GET : suspicious combination of 'OR' or 'AND' statements in URL
3.2.0
SQL injection Prevention - GET : suspicious CREATE statement in URL
3.2.0
SQL injection Prevention - GET : suspicious CAST statement in URL
3.2.0
SQL injection Prevention - GET : suspicious OPENROWSET statement in URL
3.2.0
SQL injection Prevention - GET : suspicious DECLARE statement in URL
3.2.0
SQL injection Prevention - GET : suspicious OPENQUERY statement in URL
3.2.0
SQL injection Prevention - GET : suspicious shutdown statement in URL
3.2.0
SQL injection Prevention - GET : suspicious UNION SELECT statement in URL
3.2.0
SQL injection Prevention - GET : possible database version probing
3.2.0
SQL injection Prevention - GET : suspicious UPDATE SET statement in URL
3.2.0
SQL injection Prevention - GET : suspicious SELECT statement in URL
3.2.0
SQL injection Prevention - GET : suspicious INSERT statement in URL
3.2.0
SQL injection Prevention - GET : suspicious DROP statement in URL
3.2.0
SQL injection Prevention - GET : suspicious EXEC statement in URL
3.2.0
SQL injection Prevention - GET : block comment delimiters in URL
3.2.0
SQL injection Prevention - GET : suspicious combination of 'select' and 'sleep' statements in URL
5.0.0
SQL injection Prevention - GET : Evasion attempt with CAST and EXEC statements
5.0.0
SQL injection Prevention - GET : Authentication bypass attempt with OR statement
5.0.0
SQL injection Prevention - GET : suspicious SQL keywords in URL
5.0.0
     


 
 
 
 
 Risk level 
Moderate 

 Vulnerability First Public Report Date 
2017-12-21 

 Target Type 
Server 

 Possible exploit 
Remote