Produit : Dolibarr
Type : Security Advisory
Criticité : high
CVE : CVE-2026-33944
Date source : 21/10/2026 01:08
Résumé :
### Summary
A SQL Injection vulnerability exists in the Third Party (Company) update functionality of Dolibarr ERP/CRM. The `localtax1_value` parameter (`lt1`) is concatenated
directly into an SQL UPDATE statement in `societe/class/societe.class.php` at line 1672 without any escaping, type casting, or parameterized query binding.
An authenticated user with standard "Third Party: Create/Edit" permission can extract any data from the database, including password hashes, API keys, and all
business data.
Tested on Dolibarr v23.0.0 (latest stable), default installation via official Docker image, MariaDB 10.11. No custom modules, no modified configuration.
### Details
**Vulnerable code** (`societe/class/societe.class.php`, line 1672):
« `php
$sql .= ",localtax1_value =".$this->localtax1_value;
« `
The value comes from `GETPOST('lt1', 'alpha')` (`soc
Action recommandée :
Vérifier la version installée et appliquer le correctif si le produit est concerné.
Source : Voir l’annonce officielle