CVE-2018-19998

SQL injection vulnerability in user/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the employee parameter.

References

Affected packages

Git / github.com/dolibarr/dolibarr

Affected ranges

Type

GIT

Repo

https://github.com/dolibarr/dolibarr

Events

Introduced

85180b117c86ca8a3a2639e5d484711d7c76b494

Last Affected

85180b117c86ca8a3a2639e5d484711d7c76b494

Fixed

2b088a73c121a52e006c0d76ea4da7ffeb7b4f4a

Fixed

bacd5110fbdc81a35030fdc322775fa15ea85924

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:dolibarr:dolibarr_erp\\/crm:8.0.2:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "8.0.2"
                },
                {
                    "last_affected":  "8.0.2"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "range":  [
                {
                    "fixed":  "2b088a73c121a52e006c0d76ea4da7ffeb7b4f4a"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "bacd5110fbdc81a35030fdc322775fa15ea85924"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

8.*

8.0.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-19998.json"