CVE-2020-14443: 
PHP vulnerability analysis and mitigation

A SQL injection vulnerability was discovered in Dolibarr 11.0.3, specifically in the accountancy/customer/card.php file. The vulnerability allows remote authenticated users to execute arbitrary SQL commands through manipulation of the id parameter. This vulnerability was disclosed on June 18, 2020 (NVD).

The vulnerability exists due to insufficient input validation of the 'id' parameter in the accountancy/customer/card.php file. The CVSS v3.1 base score for this vulnerability is 8.8 (HIGH), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability allows authenticated users to inject and execute arbitrary SQL commands via the id parameter (NVD).

When successfully exploited, this vulnerability allows authenticated attackers to execute arbitrary SQL commands on the underlying database. This could potentially lead to unauthorized access to sensitive data, manipulation of database contents, or compromise of the application's integrity (NVD).

The vulnerability requires authentication to exploit, meaning an attacker must have valid credentials to access the affected functionality. The attack complexity is considered low, indicating that the vulnerability is relatively straightforward to exploit once access is obtained (NVD).

The vulnerability was addressed in a subsequent release through improved input validation. A fix was implemented by adding proper type casting to the 'id' parameter using GETPOST('id', 'int') instead of the previous unsafe implementation (GitHub).