Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field

dolibarr · SQL injection · CWE-89

Affecteddolibarr

FixUpdate to 23.0.4 or newer

PublishedOct 26, 13:08 · VulnCheck

ScoredOct 26 · 7.6 · VulnCheck

Exploit code publicNone known · checked 22:18 UTC

ExploitedNone known · CISA KEV checked 22:30 UTC

What we know

No known exploitation. CISA KEV, checked 22:30 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.

An attacker needs network access and an account. CVSS: network, low privileges.

A successful attack can read data. CVSS impact.

Description

Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.

From VulnCheck

Affected and fixed versions

ProductAffectedFixed indolibarr19.0.0 – before 23.0.423.0.4dolibarrNot affected23.0.4

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

Patch Commit · github.compatch github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/companybankaccount.class.php#L399 · github.comtechnical description github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/api_thirdparties.class.php#L1852 · github.comtechnical description github.com/Dolibarr/dolibarr · github.comproduct VulnCheck Advisory: Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field · vulncheck.comthird party advisory

Other CVEs in dolibarr

All 32 →

7.2Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter · CVE-2026-116219Oct 26 6.6Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize() · CVE-2026-110874Oct 15 4.3Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php · CVE-2026-107706Oct 8