EUVD-2026-65083
GHSA-5qq2-5wmp-fh5h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible REST API with no special conditions, low privilege (user-read account), confidentiality-only impact with no integrity or availability effect on the vulnerable system.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search on numeric fields and LIKE prefix iteration on string fields to recover salary figures and password verifiers omitted from normal API responses, while raw database error messages in the same endpoint enable column name enumeration.
AnalysisAI
SQL injection in Dolibarr's users REST API (all versions before 24.0.0) allows authenticated users holding only user-read rights to exfiltrate sensitive database columns - including salary figures and password verifier hashes - that the API is explicitly designed to withhold from normal responses. The injection path targets unsanitized filter parameters concatenated directly into SQL WHERE clauses with no column-level access gating, enabling blind binary search on numeric fields and LIKE prefix iteration on string fields; raw database error messages in the same endpoint additionally leak internal column names. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid Dolibarr account with user-read API rights (PR:L); unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 with VC:H accurately reflects the high-value data exposed: password verifiers and salary figures are among the most operationally damaging payloads an ERP system can leak. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Dolibarr 24.0.0 or later, available at https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0; the specific fix is commit https://github.com/Dolibarr/dolibarr/commit/12687f83705c2a1e46aaf6f8d1ac7347bee4710c, which should be inspected to confirm parameterized queries or equivalent sanitization were applied to the filter parameter in the users REST API. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Dolibarr deployments and confirm versions in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vecto
Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code executio
Improper authorization in Dolibarr's Members REST API (all versions before 24.0.0) allows any authenticated user holding
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging suppor
Incorrect authorization in Dolibarr's payments REST API delete endpoint exposes all payment records to deletion by any a
SQL injection in Dolibarr ERP/CRM through version 23.0.3 lets authenticated REST API users exfiltrate arbitrary database
Improper authorization in Dolibarr's expense report REST API update endpoint allows authenticated users with only expens
Dolibarr's Members REST API before version 24.0.0 exposes bcrypt password hash verifiers to any authenticated user holdi
Dolibarr's REST API user-update endpoint permits any low-privileged account holding user-write rights to overwrite payro
Broken object-level authorization (BOLA) in Dolibarr's REST API bank account write routes permits any authenticated user
Broken object-level authorization (BOLA) in Dolibarr's REST API write routes for third-party site accounts allows any au
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbi
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today