Vulnerability Details CVE-2014-3992
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) entity parameter in an update action to user/fiche.php or (2) sortorder parameter to user/group/index.php.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.025
EPSS Ranking 84.5%
CVSS Severity
CVSS v2 Score 6.5
References
Products affected by CVE-2014-3992
-
cpe:2.3:a:dolibarr:dolibarr_erp/crm:3.5.3