fkie_cve-2026-33944

Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update functionality. The application concatenates the localtax1_value and localtax2_value properties into an SQL UPDATE statement without numeric conversion or other appropriate sanitization. An authenticated user with Third Party create or edit permission can submit crafted lt1 or lt2 POST parameters to read sensitive database information, including password hashes, API keys, and business data, or modify third-party records. This issue is fixed in versions 22.0.5 and 23.0.2.

GHSA-v5fq-cf5m-vwv7 — Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter

Affected: Packagist: dolibarr/dolibarr

### Summary

A SQL Injection vulnerability exists in the Third Party (Company) update functionality of Dolibarr ERP/CRM. The `localtax1_value` parameter (`lt1`) is concatenated directly into an SQL UPDATE statement in `societe/class/societe.class.php` at line 1672 without any escaping, type casting, or parameterized query binding.

An authenticated user with standard "Third Party: Create/Edit" permission can extract any data from the database, including password hashes, API keys, and all business data.

Tested on Dolibarr v23.0.0 (latest stable), default installation via official Docker image, MariaDB 10.11. No custom modules, no modified configuration.

### Details

**Vulnerable code** (`societe/class/societe.class.php`, line 1672): ```php $sql .= ",localtax1_value =".$this->localtax1_value; ```

The value comes from `GETPOST('lt1', 'alpha')` (`societe/card.php`, line 1135). The only sanitization applied is `trim()` at line 1528 — no `(float)` cast, no `$db->escape()`.

The `alpha` input filter strips HTML tags and double quotes but does **not** strip single quotes, parentheses, commas, or SQL keywords. Since the injection point is in a numeric SQL context (no quotes around the value), the attacker needs none of the filtered characters.

**Why the WAF does not block this:** Dolibarr's WAF (`waf.inc.php`) only checks SQL injection patterns in **GET** parameters, not POST. The POST-based `lt1` parameter bypasses it entirely.

**The same vuln…

Most recent entries from all

fkie_cve-2026-33944

GHSA-v5fq-cf5m-vwv7 — Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter