Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter

影響: composer:dolibarr/dolibarr <= 23.0.0

A SQL Injection vulnerability exists in the Third Party (Company) update functionality of Dolibarr ERP/CRM. The localtax1_value parameter (lt1) is concatenated directly into an SQL UPDATE statement in societe/class/societe.class.php at line 1672 without any escaping, type casting, or parameterized query binding. An authenticated user with standard "Third Party: Create/Edit" permission can extract any data from the database, including password hashes, API keys, and all business data. Tested on D…

在 GitHub Advisory Database 阅读

2026/10/27 22:29，GitHub Advisory Database 发布了“Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：PHP。CVE：CVE-2026-33944。