Security readout for executives and security teams
Plain-English summary
Dolibarr versions before 7.0.2 had an SQL injection flaw in several admin and accountancy pages. A remote attacker could send crafted sorting input that makes the application run unintended database queries. Business risk is strongest where older Dolibarr admin interfaces are internet-accessible or reachable by untrusted users.
Executive priority
Prioritize remediation for internet-facing or business-critical Dolibarr systems. Treat this as a data-risk issue because successful SQL injection can affect confidentiality and integrity, even though exploitation evidence is not provided.
Technical view
CVE-2018-9019 affects Dolibarr before 7.0.2. The CVE description identifies the sortfield parameter across multiple admin/accountancy endpoints as SQL injectable, allowing arbitrary SQL command execution. The bundle provides no CVSS score, authentication requirement, or proof of active exploitation.
Likely exposure
Exposure is likely limited to organizations running Dolibarr versions earlier than 7.0.2, especially if the listed admin or accountancy routes are reachable beyond trusted administrators.
Exploitation context
The CVE record says remote attackers can execute arbitrary SQL through sortfield. There is no KEV listing and the provided sources do not show active exploitation, exploit availability, or observed attacks.
Researcher notes
The affected endpoints are /accountancy/admin/accountmodel.php, /accountancy/admin/categories_list.php, /accountancy/admin/journals_list.php, /admin/dict.php, /admin/mails_templates.php, and /admin/website.php. Missing source details include CVSS, authentication context, and exploit telemetry.
Mitigation direction
- Upgrade Dolibarr to version 7.0.2 or later.
- Review Dolibarr vendor guidance and changelog details before maintenance.
- Restrict admin and accountancy routes to trusted networks and users.
- Monitor database activity for unexpected queries from Dolibarr.
- Back up application data before applying updates.
Validation and detection
- Inventory all Dolibarr deployments and record exact versions.
- Confirm no production instance runs a version before 7.0.2.
- Check whether listed admin and accountancy endpoints are externally reachable.
- Review logs for suspicious requests using the sortfield parameter.
- Verify the vendor patch or equivalent fixed code is present.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-9019 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpujan2021.htmlCVE reference · x_refsource_MISC
- https://github.com/Dolibarr/dolibarr/commit/83b762b681c6dfdceb809d26ce95f3667b614739CVE reference · x_refsource_CONFIRM
- https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLogCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.