A critical SQL injection vulnerability in Dolibarr ERP-CRM 8.0.4 allows unauthenticated attackers to execute arbitrary database queries and potentially compromise sensitive application data.

The application fails to properly sanitize the rowid POST parameter in the admin dict.php endpoint. This allows an attacker to inject malicious SQL commands, facilitating error-based SQL injection to extract data from the underlying database.

Successful exploitation of this vulnerability permits unauthorized access to the application database. This can lead to the exfiltration of sensitive business data, including customer information, financial records, and configuration details. With a CVSS score of 8.2, this vulnerability represents a high risk to organizational data confidentiality and integrity.

Immediate Action: As there is no official fix listed for this specific version, users must restrict access to the admin interface via network-level controls or web server configurations until an upgrade to a supported, patched version is performed.

Proactive Monitoring: Review web server and application logs for anomalous POST requests directed at the dict.php endpoint, specifically looking for SQL syntax patterns or database error strings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads in POST parameters.

Public Exploit Available: Yes — a public proof-of-concept exploit is available via ExploitDB (EDB-ID 46095).

Given the high CVSS score and the public availability of exploit code, organizations running Dolibarr ERP-CRM 8.0.4 should treat this as a high-priority risk. Immediately implement compensating controls such as WAF rules and restricted access to the administrative dashboard, and prioritize upgrading to a current, supported version of the software to eliminate the underlying flaw.