---
id: "CVE-2026-76173"
page: "https://infrastack.ai/live/CVE-2026-76173"
kind: "vulnerability"
aliases: ["CVE-2026-76173"]
title: "WhatsApp for Dolibarr 1.9 (Sgestion / EasySoft module): unauthenticated blind SQL injection in webhook receiver"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "WhatsApp for Dolibarr", "fixed": [], "affected": "1.9", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dolibarr", "dolibarr-module", "other", "self-hosted", "sql-injection", "whatsapp-module"]
not_affected_if: ["default-config", "module-not-installed", "webhook-disabled"]
published_at: "2026-11-12T10:17:29+00:00"
first_seen_at: "2026-11-12T10:37:45+00:00"
updated_at: "2026-11-12T10:41:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76173", "first_seen_at": "2026-11-12T10:37:45+00:00"}, {"source": "analyst", "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-whatsapp-dolibarr-sgestion-easysoft", "first_seen_at": "2026-11-12T10:41:54+00:00", "cites": ["https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-whatsapp-dolibarr-sgestion-easysoft"]}]
exploit_sources: []
---

# WhatsApp for Dolibarr 1.9 (Sgestion / EasySoft module): unauthenticated blind SQL injection in webhook receiver

Link for people: https://infrastack.ai/live/CVE-2026-76173 (this .md is for agents)

The third-party module WhatsApp for Dolibarr 1.9 (Sgestion / EasySoft), not Dolibarr core, takes the phone number from data.key.remoteJid in a JSON request to public/webhook/receiver.php and puts it into an SQL query without escaping. When WHATSAPP_WEBHOOK_ALLOW is enabled, an unauthenticated remote attacker could use timing-based blind injection to extract database contents and disrupt the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WhatsApp for Dolibarr affected 1.9 fixed no fixed version listed

## How to check

Check whether the WhatsApp for Dolibarr module (Sgestion / EasySoft) version 1.9 is installed (look for public/webhook/receiver.php in the module directory) and whether the WHATSAPP_WEBHOOK_ALLOW option is enabled in Dolibarr setup. Also check web logs for requests to the receiver with unusual remoteJid values.

## Fix

INCIBE says the manufacturer confirmed a patch is already deployed, but no fixed version number is named. Contact Sgestion / EasySoft or the vendor's marketplace page for the updated module. Until then, disable WHATSAPP_WEBHOOK_ALLOW or block public access to the receiver.php endpoint.

## Timeline

- 2026-11-12T10:37:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76173
- 2026-11-12T10:41:54+00:00 analyst https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-whatsapp-dolibarr-sgestion-easysoft — Only INCIBE advisory (CNA) and CVE text available; third-party module, not Dolibarr core. No fixed version named, no exploitation or PoC found. Nothing verified.

## Documents

- [advisory] INCIBE-CERT: SQL injection in WhatsApp for Dolibarr by Sgestion / EasySoft https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-whatsapp-dolibarr-sgestion-easysoft

## From the sources

Blind SQL injection vulnerability in the public endpoint `public/webhook/receiver.php` of the WhatsApp module for Dolibarr 1.9. The phone number value derived from the `data.key.remoteJid` parameter, received via a JSON request, is incorporated into an SQL query without escaping or parameterization. With the WHATSAPP_WEBHOOK_ALLOW option enabled, an unauthenticated remote attacker could manipulate this parameter to alter the query. Exploitation using a timing-based technique could allow an attacker to extract information from the database and cause service disruption.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_