CVE-2019-25452

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-25452
Dolibarr ERP/CRM 10.0.1 contains an SQL injection vulnerability in the elemid POST parameter of the viewcat.php endpoint that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can submit crafted POST requests with malicious SQL payloads in the elemid parameter to extract sensitive database information using error-based or time-based blind SQL injection techniques.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.exploit-db.com/exploits/47362 Exploit VDB Entry
https://www.vulncheck.com/advisories/dolibarr-erpcrm-sql-injection-via-elemid Broken Link
Configurations

Configuration 1 (hide)

cpe:2.3:a:dolibarr:dolibarr_erp\/crm:10.0.1:*:*:*:*:*:*:*
History

02 Mar 2026, 15:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.2 		v2 : unknown
v3 : 7.5

25 Feb 2026, 18:29

Type Values Removed Values Added
References () https://www.exploit-db.com/exploits/47362 - () https://www.exploit-db.com/exploits/47362 - Exploit, VDB Entry
References () https://www.vulncheck.com/advisories/dolibarr-erpcrm-sql-injection-via-elemid - () https://www.vulncheck.com/advisories/dolibarr-erpcrm-sql-injection-via-elemid - Broken Link
CPE cpe:2.3:a:dolibarr:dolibarr_erp\/crm:10.0.1:*:*:*:*:*:*:*
First Time Dolibarr
Dolibarr dolibarr Erp\/crm

23 Feb 2026, 18:13

Type Values Removed Values Added
Summary
  • (es) Dolibarr ERP/CRM 10.0.1 contiene una vulnerabilidad de inyección SQL en el parámetro POST elemid del endpoint viewcat.php que permite a atacantes no autenticados ejecutar consultas SQL arbitrarias. Los atacantes pueden enviar solicitudes POST manipuladas con cargas útiles SQL maliciosas en el parámetro elemid para extraer información sensible de la base de datos utilizando técnicas de inyección SQL ciega basada en errores o basada en tiempo.

22 Feb 2026, 14:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-22 14:16

Updated : 2026-03-02 15:16

NVD link : CVE-2019-25452

Mitre link : CVE-2019-25452

CVE.ORG link : CVE-2019-25452

JSON object : View

Products Affected

dolibarr

  • dolibarr_erp\/crm
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')