Dolibarr ERP/CRM 10.0.1 contains critical SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries and exfiltrate sensitive data.

This vulnerability consists of multiple SQL injection flaws within the application, specifically affecting the card.php endpoint. Authenticated attackers can inject malicious SQL code through POST parameters, including actioncode, demand_reason_id, and availability_id, to perform blind or error-based data extraction.

Successful exploitation of these vulnerabilities allows an attacker to bypass standard database query logic, leading to the unauthorized disclosure of sensitive business information. Given the CVSS score of 7.1, this flaw poses a significant risk to the confidentiality of organizational data stored within the ERP system. Unauthorized database access may also facilitate further compromise, potentially leading to additional data breaches or loss of system integrity.

Immediate Action: As no specific patch version is provided, users should review vendor security bulletins and upgrade to the latest supported version of Dolibarr ERP/CRM to ensure all known SQL injection vectors are remediated.

Proactive Monitoring: Security teams should monitor web server and application logs for suspicious POST requests containing SQL syntax, such as UNION, SELECT, or SLEEP commands, directed at card.php endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect incoming POST traffic and block requests containing malicious database query patterns.

Public Exploit Available: Yes — a proof-of-concept exists via the Exploit Database (EDB-ID 47370).

The presence of multiple documented SQL injection vectors in Dolibarr ERP/CRM 10.0.1 presents a substantial risk to data privacy. Administrators must prioritize updating their installations to a patched version immediately to eliminate these entry points. If an immediate update is not feasible, restrict access to the application and implement robust input validation or WAF rules to mitigate the threat.