LiveActive security incident?Get immediate response
CVE Record

CVE-2018-13450: SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers t...

SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the status_batch parameter.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

Dolibarr ERP/CRM 7.0.3 has a reported SQL injection in product/card.php through the status_batch parameter. If reachable by an attacker, this could allow unauthorized database commands. The public bundle does not provide CVSS, authentication requirements, or a fixed release.

Executive priority

Prioritize inventory and remediation if Dolibarr 7.0.3 is in use, especially on externally reachable systems. Business urgency is potentially significant because SQL injection can affect sensitive ERP/CRM data, but the available evidence does not quantify severity or exploitation.

Technical view

CVE-2018-13450 describes SQL injection in Dolibarr ERP/CRM 7.0.3, affecting product/card.php via status_batch. The stated impact is arbitrary SQL command execution. The only remediation-related source in the bundle is a Dolibarr GitHub commit reference; no CVSS vector or CWE mapping is provided.

Likely exposure

Organizations are exposed if they run Dolibarr ERP/CRM 7.0.3 and the affected product/card.php route is reachable to untrusted users. Exposure depends on deployment, access controls, and whether the referenced vendor change or a later supported release is installed.

Exploitation context

The bundle does not show CISA KEV listing, active exploitation, exploit availability, authentication requirements, or internet-scale activity. Treat exploitation status as unconfirmed based on the provided sources.

Researcher notes

The record is sparse: no CVSS, CWE, affected CPEs, authentication context, or fixed version is included. Analysis should center on confirming version 7.0.3, reachability of product/card.php, and whether the referenced Dolibarr commit or later vendor release is deployed.

Mitigation direction

  • Identify any Dolibarr ERP/CRM 7.0.3 deployments.
  • Check Dolibarr vendor guidance for the fixed release or supported remediation.
  • Review the referenced Dolibarr commit for code-level remediation context.
  • Limit untrusted access to affected Dolibarr routes until remediation is confirmed.
  • Back up and review affected databases before and after remediation.

Validation and detection

  • Confirm the running Dolibarr version on each instance.
  • Verify whether the referenced Dolibarr code change is present.
  • Review web logs for unusual product/card.php and status_batch activity.
  • Confirm database integrity where affected instances were externally reachable.
  • Document exposure assumptions, including authentication and network access controls.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-13450 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.