Executive brief
Dolibarr ERP CRM, a popular open-source suite for managing business operations like sales and inventory, contains a security flaw in its Shipments API. An attacker with low-level access could potentially manipulate database queries to view or modify sensitive business data. While the attack is complex to execute, a public exploit exists, and the vendor has not yet released a fix.
Technical details
A SQL injection vulnerability exists in Dolibarr ERP CRM versions up to and including 23.0.2. The flaw is located in the `_checkValForAPI` function within `htdocs/expedition/class/expedition.class.php`, specifically affecting the Shipments API Endpoint. An attacker can exploit this by manipulating the 'fields' argument in API requests. While the attack can be performed remotely, it requires 'Low' privileges and is characterized by 'High' attack complexity. Successful exploitation allows for unauthorized database queries, potentially leading to data exfiltration or modification. As of the advisory date, no patch is available, and the vendor has not responded to disclosure attempts.
Affected products
- Dolibarr Dolibarr ERP CRM <= 23.0.2
Timeline
- 2026-05-03: advisory: Initial disclosure and NVD publication
- 2026-05-11: other: GitHub Advisory reviewed and updated