Executive brief
Dolibarr is an open-source ERP and CRM system used by businesses to manage contacts, invoices, orders, and accounting. This vulnerability allows users with import permissions to inject SQL commands through the CSV/XLSX import feature, potentially exposing sensitive business data from the database or modifying records during import operations.
Technical details
A SQL injection vulnerability exists in the CSV and XLSX import wizard (htdocs/imports/import.php and htdocs/core/modules/import/import_csv.modules.php). The vulnerability arises because the wizard reads user-supplied update keys via GETPOST('updatekeys', 'array') and applies only a basic HTML strip filter that leaves SQL syntax intact. The import_insert() function then constructs WHERE clauses by concatenating these keys directly into SQL queries without parameterized statements. An attacker can inject UNION SELECT statements to exfiltrate arbitrary table content; the attacker-controlled integer result redirects which rows are updated. The attack requires the import permission but no other authentication bypass. The fix (allowlist validation of column codes) was added in version 24.0.0; versions before 24.0.0, including 23.0.4, are vulnerable.
Affected products
- Dolibarr Dolibarr before 24.0.0
Timeline
- 2026-08-27: disclosed