CVE-2024-5315: Dolibarr vulnerable to SQL Injection

May 24, 2024 (updated April 10, 2025)

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters in /dolibarr/commande/list.php.

References

github.com/Dolibarr/dolibarr
github.com/advisories/GHSA-q8x7-jc3h-p8xc
nvd.nist.gov/vuln/detail/CVE-2024-5315
www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dolibarrs-erp-cms

Code Behaviors & Features

Detect and mitigate CVE-2024-5315 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →