Dolibarr Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2021-36625)

Description

An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statement.

Remediation

References

CVE-2021-36625

Related Vulnerabilities

Oracle JRE CVE-2013-2442 Vulnerability (CVE-2013-2442)

IBM RTC Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-4920)

WordPress Plugin DZS Video Gallery Information Disclosure (3.1.3)

Jenkins Incorrect Authorization Vulnerability (CVE-2021-21670)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-6163)

Severity

High

Classification

CVE-2021-36625 CWE-138 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H