Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter
影響: composer:dolibarr/dolibarr <= 23.0.0
A SQL Injection vulnerability exists in the Third Party (Company) update functionality of Dolibarr ERP/CRM. The localtax1_value parameter (lt1) is concatenated directly into an SQL UPDATE statement in societe/class/societe.class.php at line 1672 without any escaping, type casting, or parameterized query binding. An authenticated user with standard "Third Party: Create/Edit" permission can extract any data from the database, including password hashes, API keys, and all business data. Tested on D…
Read on GitHub Advisory Database
| CVE | CVE-2026-33944 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/28/2026, 06:03 AM |
| Data | Markdown JSON |
On 10/27/2026, 10:29 PM, GitHub Advisory Database published "Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter" (type: Advisory). Severity is "High" (high). Related technologies: PHP. CVE: CVE-2026-33944.