CVE-2019-25710 Dolibarr CVE debrief

Who should care

Dolibarr ERP-CRM administrators, security teams, and IT professionals responsible for maintaining and securing Dolibarr ERP-CRM installations should be aware of this vulnerability. They should review and update Dolibarr ERP-CRM to a secure version, restrict access to the admin dict.php endpoint, and monitor for suspicious SQL queries and database activity. Affected operator, platform, vulnerability-management, and security-team impact require immediate of

Why it matters

CVE-2019-25710 is a high-severity SQL injection vulnerability in Dolibarr ERP-CRM 8.0.4 that requires immediate attention from administrators and security teams to prevent potential exploitation and data breaches.

• Potential extraction of sensitive database information
• Possible execution of arbitrary SQL queries
• Required review and update of Dolibarr ERP-CRM to a secure version
• Need for input validation and sanitization to prevent similar vulnerabilities

Technical summary

The vulnerability is an SQL injection issue in the rowid parameter of the admin dict.php endpoint in Dolibarr ERP-CRM 8.0.4. This allows attackers to execute arbitrary SQL queries, potentially leading to sensitive database information extraction. The vulnerability requires immediate attention from administrators and security teams to prevent potential exploitation and data breaches. Affected product context and defensive impact are critical for understanding the vulnerability's operational impact. Input validation and sanitization can prevent similar vulnerabilities.

Defensive priority

High priority for Dolibarr ERP-CRM administrators and security teams

Recommended defensive actions

• Review and update Dolibarr ERP-CRM to a version that is not vulnerable
• Restrict access to the admin dict.php endpoint
• Monitor for suspicious SQL queries and database activity
• Implement input validation and sanitization for user input
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the SQL injection vulnerability in Dolibarr ERP-CRM 8.0.4. The vulnerability is in the rowid parameter of the admin dict.php endpoint. Grounding from the CVE Program and NIST NVD detail pages confirms the vulnerability's existence and impact. Defenders should verify affected scope, severity, and vendor guidance. The official product homepage and ExploitDB entry provide additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.