Dolibarr ERP/CRM SQL Injection Vulnerability in viewcat.php Endpoint

A SQL injection vulnerability has been identified in Dolibarr ERP/CRM version 10.0.1. The issue resides in the elemid POST parameter of the viewcat.php endpoint, allowing unauthenticated attackers to execute arbitrary SQL queries. Exploitation involves sending crafted POST requests with malicious SQL payloads in the elemid parameter, enabling the extraction of sensitive database information through error-based or time-based blind SQL injection techniques.

Impact

Exploitation of this vulnerability allows for arbitrary SQL query execution, potentially leading to unauthorized data access or manipulation.

Reproduction

To reproduce this vulnerability, send a POST request to the viewcat.php endpoint with the elemid parameter containing a crafted SQL payload. The request should include a valid session cookie. The vulnerability can be exploited using either error-based or time-based blind SQL injection techniques.