Description

A security flaw has been discovered in Dolibarr up to 23.0.3. Affected is an unknown function of the file htdocs/user/card.php of the component User Cloning. The manipulation of the argument ID results in ldap injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 798e65356ede03c2812ab1a728f23fae34de5592. It is advisable to implement a patch to correct this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-16T04:16:26.747Z",
  "pubdate": "2026-08-16T04:16:26.747Z",
  "executiveSummary": "An LDAP injection vulnerability has been identified in Dolibarr up to 23.0.3, specifically within the User Cloning component located in htdocs/user/card.php.\nThe vulnerability allows remote attackers to manipulate the ID argument, leading to unauthorized LDAP query manipulation.\nThe flaw poses significant risk implications regarding directory service integrity and confidentiality, as a public exploit has been released and is actively available for exploitation.\nSuccessful exploitation requires network connectivity to the vulnerable Dolibarr instance, enabling remote threat actors to execute arbitrary LDAP queries without prior authentication depending on system configuration.",
  "technicalDetails": "The root cause of the vulnerability is insufficient input sanitization and improper output encoding of user-supplied data passed via the ID argument to the LDAP query generation logic within the htdocs/user/card.php file.\nThe vulnerable component is the User Cloning feature of Dolibarr, affecting all software versions up to 23.0.3.\nThe attack vector is network-based, allowing remote adversaries to interact directly with the application interface hosting the vulnerable script.\nThe attack flow proceeds as follows: First, the attacker identifies the target Dolibarr installation running an affected version. Second, the attacker crafts a malicious input payload containing LDAP control characters and syntax injections designed to alter the logical structure of directory search filters. Third, the attacker submits this payload via the ID parameter in an HTTP request targeting htdocs/user/card.php. Fourth, the application embeds the unsanitized input directly into internal LDAP queries executed against the backend directory server. Finally, the manipulated query executes, allowing the attacker to bypass authentication logic, extract sensitive directory information, or manipulate directory service objects depending on the permissions of the bind user account.\nPost-exploitation impact includes unauthorized data disclosure from the connected LDAP directory, potential privilege escalation, or disruption of directory service operations."
}