Description

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search on numeric fields and LIKE prefix iteration on string fields to recover salary figures and password verifiers omitted from normal API responses, while raw database error messages in the same endpoint enable column name enumeration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-24T20:17:12.957Z",
  "pubdate": "2026-08-24T20:17:12.957Z",
  "executiveSummary": "Dolibarr before 24.0.0 suffers from a SQL injection vulnerability located within the users REST API endpoint. The flaw permits authenticated attackers possessing user-read rights to systematically extract sensitive data from the underlying database by exploiting unsanitized filter parameters that are spliced directly into SQL WHERE clauses without column restrictions.\nThe vulnerability significantly impacts confidentiality by allowing malicious actors to recover highly sensitive information normally omitted from standard API responses, such as internal salary figures and password verifiers. Additionally, raw database error messages exposed via the same endpoint facilitate database schema enumeration, including column name discovery.\nAttackers leverage algorithmic extraction techniques, performing binary search methodologies on numeric database fields and LIKE prefix iterations on string-based fields to automate data exfiltration. Exploitation strictly requires authentication and user-read privileges, limiting unauthenticated access but presenting substantial risk within multi-tenant or compromised user contexts across affected Dolibarr deployments.",
  "technicalDetails": "The vulnerability resides in the users REST API component of Dolibarr prior to version 24.0.0. The root cause of the security defect stems from inadequate input sanitization and improper parameter handling, where user-supplied filter parameters are concatenated directly into SQL WHERE clauses without applying strict column white-listing or proper parameterized query construction.\nExploitation of this flaw requires the attacker to possess an active authenticated session with user-read permissions. Network exposure is defined by the accessibility of the Dolibarr REST API interface. Because the endpoint fails to restrict queryable columns, an attacker can manipulate filter parameters to construct arbitrary SQL expressions.\nThe attack flow proceeds in a systematic, iterative manner. First, the attacker leverages raw database error messages returned by the vulnerable REST API endpoint to perform column name enumeration, mapping the database schema of the underlying data store. Once target columns—such as salary figures and password verifiers—are identified, the attacker crafts specialized payload behaviors depending on the data type of the target field.\nFor numeric fields, the attacker executes boolean-based or error-based binary search queries to efficiently extract numerical values like compensation data. For string fields, the attacker utilizes LIKE prefix iteration techniques to incrementally disclose sensitive strings, including password verifiers normally excluded from the API response payload.\nThe post-exploitation impact includes the total compromise of sensitive user attributes stored within the database. Attackers can bypass application-layer response filtering to harvest internal financial records and credential material, facilitating further attacks such as credential cracking or privilege escalation within the Dolibarr environment."
}