{"id":"CVE-2026-33944","published":"2026-11-05T22:18:41.777","lastModified":"2026-11-05T22:18:41.937","description":"Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update functionality. The application concatenates the  localtax1_value  and  localtax2_value  properties into an SQL UPDATE statement without numeric conversion or other appropriate sanitization. An authenticated user with Third Party create or edit permission can submit crafted  lt1  or  lt2  POST parameters to read sensitive database information, including password hashes, API keys, and business data, or modify third-party records. This issue is fixed in versions 22.0.5 and 23.0.2.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Dolibarr/dolibarr/commit/a06b14b7dc39d33f8fa00c9b27f2913b494885cb","tags":[]},{"url":"https://github.com/Dolibarr/dolibarr/commit/c83c13305240c2c0a3779e678b57238b32d15e7c","tags":[]},{"url":"https://github.com/Dolibarr/dolibarr/pull/37632","tags":[]},{"url":"https://github.com/Dolibarr/dolibarr/releases/tag/22.0.5","tags":[]},{"url":"https://github.com/Dolibarr/dolibarr/releases/tag/23.0.2","tags":[]},{"url":"https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-v5fq-cf5m-vwv7","tags":[]},{"url":"https://www.sec4check.pl/blog/posts/cve-dolibarr-sql-injection-localtax-third-party.html","tags":[]}],"exploitRefs":[{"url":"https://github.com/Dolibarr/dolibarr/commit/a06b14b7dc39d33f8fa00c9b27f2913b494885cb","tags":[]},{"url":"https://github.com/Dolibarr/dolibarr/commit/c83c13305240c2c0a3779e678b57238b32d15e7c","tags":[]},{"url":"https://github.com/Dolibarr/dolibarr/pull/37632","tags":[]},{"url":"https://github.com/Dolibarr/dolibarr/releases/tag/22.0.5","tags":[]},{"url":"https://github.com/Dolibarr/dolibarr/releases/tag/23.0.2","tags":[]},{"url":"https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-v5fq-cf5m-vwv7","tags":[]}],"hasPoc":true,"ai":{"summary":"A SQL injection flaw exists in Dolibarr's third-party company update functionality due to unsanitized concatenation of user-controlled 'lt1' and 'lt2' POST parameters into an SQL UPDATE statement, allowing authenticated attackers with edit permissions to read sensitive data or modify records.","exploitability":"Exploitation requires valid authentication and third-party edit permissions, making it accessible to compromised or low-privilege accounts.","blast_radius":"Successful exploitation could lead to full database compromise, exposing password hashes, API keys, and business-critical third-party data.","remediation":"Upgrade to Dolibarr version 22.0.5 or 23.0.2 (or later) to patch the SQL injection vulnerability in the third-party update endpoint.","detection":"Look for SQL syntax errors or unexpected patterns in web server access logs for requests to the third-party update endpoint containing non-numeric values in 'lt1' or 'lt2' POST parameters; also monitor for anomalous database query logs showing UPDATE statements with string literals in numeric fields.","tags":["sql-injection","web","authentication-bypass","data-exfiltration"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:55:47.828Z"}}