Skip to main content

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2022-4093

Severity High
Score 9.8/10

Summary

Time-based SQL Injection attacks in dolibarr/dolibarr can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization's systems, leading to a long-term compromise that can go unnoticed for an extended period. This affects versions 16.0.1 and 16.0.2 only. NOTE: The affected versions of this package are not available in a package manager we support.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-89 - SQL Injection

Structured Query Language (SQL) injection attacks are one of the most common types of vulnerabilities. They exploit weaknesses in vulnerable applications to gain unauthorized access to backend databases. This often occurs when an attacker enters unexpected SQL syntax in an input field. The resulting SQL statement behaves in the background in an unintended manner, which allows the possibility of unauthorized data retrieval, data modification, execution of database administration operations, and execution of commands on the operating system.

Advisory Timeline

  • Published