Description:
SQL injection has been found and confirmed within the software as an authenticated user. A successful attack could allow an authenticated attacker to access information such as usernames and password hashes that are stored in the database.
Details:
The following URL and parameters have been confirmed to suffer from various forms of SQL injections.
POST /dolibarr/product/liste.php HTTP/1.1
Host: 192.168.56.103
[...]
Cookie: DOLSESSID_bca8ba010461ef1336d17dcd7836c25c=29mufjtdcngabkspms4169dkr3
snom=address@hidden&sortorder=ASC07356377&sref=address@hidden&token=fbb496299c4898552cde8e500a4ca985&tosell=0<SQL injection>&action="" />
Impact:
An attacker would be able to exfiltrate the database, user credentials and in certain setup access the underling operating system.
___
If you have any questions, feel free to let me know.
Please be aware we ask that vendors keep us updated on their progress during our coordination prior to disclosure.