Executive brief
Dolibarr, an open-source ERP and CRM software suite, contains a security vulnerability in its application programming interface (API). An authorized user with low-level access can bypass security filters to run unauthorized database commands. This allows an attacker to steal sensitive information from the entire database, including user passwords and secret API keys, potentially leading to a full system takeover.
Technical details
A SQL injection vulnerability exists in Dolibarr through version 23.0.3 due to the use of legacy filtering logic in the 'setup dictionary' and 'multicurrencies' REST API endpoints. The affected components, api_setup.class.php and api_multicurrencies.class.php, utilize a legacy validation method that only checks for balanced parentheses and fails to sanitize text outside of matched triplets. An authenticated attacker can provide a malicious 'sqlfilters' query parameter containing a UNION SELECT statement, which is concatenated directly into the SQL WHERE clause. This enables the exfiltration of sensitive data such as password hashes and API keys. The issue is resolved by migrating these endpoints to the hardened forgeSQLFromUniversalSearchCriteria() function, as seen in commit 14db36e.
Affected products
- Dolibarr Dolibarr through 23.0.3
Timeline
- 2026-06-13: disclosed: Issue reported on GitHub
- 2026-06-13: patched: Fix merged in commit 14db36e
- 2026-06-30: advisory: NVD publication date
References
- https://github.com/Dolibarr/dolibarr/commit/14db36e8486ef725b0d493d97abb2950a54358d3
- https://github.com/Dolibarr/dolibarr/issues/38768
- https://github.com/Dolibarr/dolibarr/pull/38794
- https://www.vulncheck.com/advisories/dolibarr-sql-injection-via-sqlfilters-parameter-in-multiple-rest-api-list-endpoints