An authenticated SQL injection vulnerability in the Dolibarr import wizard allows attackers to exfiltrate database content or manipulate row targets.

The vulnerability exists in the CSV and XLSX import wizard, where the application fails to adequately sanitize the updatekeys parameter. An authenticated user with import permissions can inject malicious SQL commands, which are then executed directly by the database handler, leading to potential data exfiltration or unauthorized record modification.

The flaw poses a significant risk to data integrity and confidentiality. By exploiting this SQL injection, an attacker can bypass standard application logic to exfiltrate sensitive information from the database or overwrite existing records. Given the CVSS score of 8.1, this is a high-severity issue that could result in substantial unauthorized access to business-critical data.

Immediate Action: Upgrade to Dolibarr version 24.0.0 or later, which introduces a necessary allow-list check to neutralize the injection vector.

Proactive Monitoring: Review database access logs for anomalous query patterns, specifically looking for unexpected UNION SELECT statements or unauthorized modifications originating from the import module.

Compensating Controls: Ensure that the import permission is restricted to trusted administrative accounts only, and utilize a Web Application Firewall (WAF) to detect and block common SQL injection payloads.

Public Exploit Available: No (exploit_available: false)

The vulnerability represents a critical risk to the security of your Dolibarr instance. Because the flaw allows for unauthorized database interaction, it is imperative that administrators prioritize the update to version 24.0.0 immediately. Restricting import privileges to highly trusted users remains a necessary secondary measure until the patch is successfully deployed across the environment.