{"id":"CVE-2026-76173","kind":"vulnerability","aliases":["CVE-2026-76173"],"related":[],"title":"WhatsApp for Dolibarr 1.9 (Sgestion / EasySoft module): unauthenticated blind SQL injection in webhook receiver","description":"Blind SQL injection vulnerability in the public endpoint `public/webhook/receiver.php` of the WhatsApp module for Dolibarr 1.9. The phone number value derived from the `data.key.remoteJid` parameter, received via a JSON request, is incorporated into an SQL query without escaping or parameterization. With the WHATSAPP_WEBHOOK_ALLOW option enabled, an unauthenticated remote attacker could manipulate this parameter to alter the query. Exploitation using a timing-based technique could allow an attacker to extract information from the database and cause service disruption.","summary":"The third-party module WhatsApp for Dolibarr 1.9 (Sgestion / EasySoft), not Dolibarr core, takes the phone number from data.key.remoteJid in a JSON request to public/webhook/receiver.php and puts it into an SQL query without escaping. When WHATSAPP_WEBHOOK_ALLOW is enabled, an unauthenticated remote attacker could use timing-based blind injection to extract database contents and disrupt the service.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WhatsApp for Dolibarr","fixed":[],"affected":"1.9","ecosystem":"vendor"}],"ecosystems":[],"tags":["dolibarr","dolibarr-module","other","self-hosted","sql-injection","whatsapp-module"],"not_affected_if":["default-config","module-not-installed","webhook-disabled"],"how_to_check":"Check whether the WhatsApp for Dolibarr module (Sgestion / EasySoft) version 1.9 is installed (look for public/webhook/receiver.php in the module directory) and whether the WHATSAPP_WEBHOOK_ALLOW option is enabled in Dolibarr setup. Also check web logs for requests to the receiver with unusual remoteJid values.","fix":"INCIBE says the manufacturer confirmed a patch is already deployed, but no fixed version number is named. Contact Sgestion / EasySoft or the vendor's marketplace page for the updated module. Until then, disable WHATSAPP_WEBHOOK_ALLOW or block public access to the receiver.php endpoint.","status":"open","published_at":"2026-11-12T10:17:29+00:00","first_seen_at":"2026-11-12T10:37:45+00:00","triaged_at":"2026-11-12T10:39:40+00:00","updated_at":"2026-11-12T10:41:54+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-12T10:39:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Dolibarr WhatsApp module: blind SQL injection lets unauthenticated attackers read database","impact":"high","summary":"The WhatsApp webhook receiver in Dolibarr 1.9 puts a phone number taken from a JSON request into an SQL query without escaping. An unauthenticated remote attacker can use timing-based blind SQL injection to extract database contents and disrupt the service.","audience":"businesses","category":"other","nicknames":[],"who_cares":["dolibarr","self-hosted","whatsapp-module"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"database contents readable by unauthenticated remote attacker","analyst_note":"Confirm the affected version range and fixed release from the NVD entry or the Dolibarr project advisory; the sources here name no fixed version.","how_to_check":"- Check whether the WhatsApp module is installed and whether the `WHATSAPP_WEBHOOK_ALLOW` option is enabled in Dolibarr setup.\n- Look for the file `public/webhook/receiver.php` under the Dolibarr install directory.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","module-not-installed"],"who_is_affected":"Only installations that run the Dolibarr WhatsApp module with the WHATSAPP_WEBHOOK_ALLOW option enabled are exposed, because that option opens the public webhook endpoint to unauthenticated requests. Teams that do not use the WhatsApp module or keep the webhook option off can skip it. The sources do not name a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000769,"input_tokens":4656,"output_tokens":607,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected version range and fixed release from the NVD entry or the Dolibarr project advisory; the sources here name no fixed version.","search":"'-2026':16A,19A '-76173':17A,20A '1.9':4A,46B,113C 'allow':76B,142C,165C 'alter':154C 'attack':82B,148C,167C 'base':87B,162C 'blind':9A,88B,98C 'caus':175C 'content':93B 'core':51B 'could':83B,149C,164C 'cve':15A,18A 'data.key.remotejid':57B,121C 'databas':92B,173C 'deriv':118C 'disrupt':95B,177C 'dolibarr':3A,23A,24B,26B,45B,50B,112C 'dolibarr-modul':25B 'easysoft':6A,48B 'enabl':78B,144C 'endpoint':105C 'escap':72B,135C 'exploit':157C 'extract':91B,169C 'for':22A 'host':31B 'incorpor':129C 'inform':170C 'inject':11A,34B,89B,100C 'json':60B,126C 'manipul':150C 'modul':7A,27B,37B,42B,110C 'number':55B,116C 'option':143C 'paramet':122C,152C 'parameter':137C 'parti':41B 'phone':54B,115C 'public':104C 'public/webhook/receiver.php':63B,106C 'put':65B 'queri':70B,133C,156C 'receiv':14A,123C 'remot':81B,147C 'request':61B,127C 'self':30B 'self-host':29B 'servic':97B,176C 'sgestion':5A,47B 'sql':10A,33B,69B,99C,132C 'sql-inject':32B 'take':52B 'techniqu':163C 'third':40B 'third-parti':39B 'time':86B,161C 'timing-bas':85B,160C 'unauthent':8A,80B,146C 'use':84B,158C 'valu':117C 'via':124C 'vulner':101C 'webhook':13A,75B,141C 'whatsapp':1A,21A,36B,43B,74B,109C,140C 'whatsapp-modul':35B 'without':71B,134C","nicknames":[],"mitigations":[],"who_affected":"Only installations that run the Dolibarr WhatsApp module with the WHATSAPP_WEBHOOK_ALLOW option enabled are exposed, because that option opens the public webhook endpoint to unauthenticated requests. Teams that do not use the WhatsApp module or keep the webhook option off can skip it. The sources do not name a fixed version.","tier":"B","verified":{"who_affected":{"at":"2026-11-12T10:41:54Z","by":"analyst","doc":"https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-whatsapp-dolibarr-sgestion-easysoft","run_id":3726}},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["fordolibarr","whatsappfordolibarr"],"ptokens":["dolibarr","for","whatsapp"],"labels":["dolibarr","dolibarrmodule","high","other","selfhosted","sqlinjection","whatsappmodule"],"campaign_type":null,"search_a":"'-2026':16A,19A '-76173':17A,20A '1.9':4A 'blind':9A 'cve':15A,18A 'dolibarr':3A,23A 'easysoft':6A 'for':22A 'inject':11A 'modul':7A 'receiv':14A 'sgestion':5A 'sql':10A 'unauthent':8A 'webhook':13A 'whatsapp':1A,21A","search_b":"'1.9':46B 'allow':76B 'attack':82B 'base':87B 'blind':88B 'content':93B 'core':51B 'could':83B 'data.key.remotejid':57B 'databas':92B 'disrupt':95B 'dolibarr':24B,26B,45B,50B 'dolibarr-modul':25B 'easysoft':48B 'enabl':78B 'escap':72B 'extract':91B 'host':31B 'inject':34B,89B 'json':60B 'modul':27B,37B,42B 'number':55B 'parti':41B 'phone':54B 'public/webhook/receiver.php':63B 'put':65B 'queri':70B 'remot':81B 'request':61B 'self':30B 'self-host':29B 'servic':97B 'sgestion':47B 'sql':33B,69B 'sql-inject':32B 'take':52B 'third':40B 'third-parti':39B 'time':86B 'timing-bas':85B 'unauthent':80B 'use':84B 'webhook':75B 'whatsapp':36B,43B,74B 'whatsapp-modul':35B 'without':71B","search_c":"'1.9':113C 'allow':142C,165C 'alter':154C 'attack':148C,167C 'base':162C 'blind':98C 'caus':175C 'could':149C,164C 'data.key.remotejid':121C 'databas':173C 'deriv':118C 'disrupt':177C 'dolibarr':112C 'enabl':144C 'endpoint':105C 'escap':135C 'exploit':157C 'extract':169C 'incorpor':129C 'inform':170C 'inject':100C 'json':126C 'manipul':150C 'modul':110C 'number':116C 'option':143C 'paramet':122C,152C 'parameter':137C 'phone':115C 'public':104C 'public/webhook/receiver.php':106C 'queri':133C,156C 'receiv':123C 'remot':147C 'request':127C 'servic':176C 'sql':99C,132C 'techniqu':163C 'time':161C 'timing-bas':160C 'unauthent':146C 'use':158C 'valu':117C 'via':124C 'vulner':101C 'webhook':141C 'whatsapp':109C,140C 'without':134C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T10:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76173","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76173","severity":null,"published_at":"2026-11-12T10:17:29+00:00","modified_at":"2026-11-12T10:17:29+00:00","first_seen_at":"2026-11-12T10:37:45+00:00","fetched_at":"2026-11-12T10:37:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76173:3726","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-whatsapp-dolibarr-sgestion-easysoft","severity":null,"published_at":"2026-11-12T10:41:54+00:00","modified_at":"2026-11-12T10:41:54+00:00","first_seen_at":"2026-11-12T10:41:54+00:00","fetched_at":"2026-11-12T10:41:54+00:00","note":"Only INCIBE advisory (CNA) and CVE text available; third-party module, not Dolibarr core. No fixed version named, no exploitation or PoC found. Nothing verified.","cites":["https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-whatsapp-dolibarr-sgestion-easysoft"]}],"documents":[{"id":134097,"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-whatsapp-dolibarr-sgestion-easysoft","title":"INCIBE-CERT: SQL injection in WhatsApp for Dolibarr by Sgestion / EasySoft","kind":"advisory","source":"analyst","publisher":null,"text":"Blind SQL injection in public/webhook/receiver.php of WhatsApp for Dolibarr 1.9 (Sgestion/EasySoft), data.key.remoteJid unescaped; requires WHATSAPP_WEBHOOK_ALLOW enabled; unauthenticated; CVSS v4 8.8. Manufacturer confirmed a patch is already deployed; no fixed version named.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}