Description

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the case-insensitive database column resolution against the case-sensitive denylist check in the core library to use prefix-matching predicates as a boolean oracle and extract full password hashes for any user account, including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-11T16:17:48.680Z",
  "pubdate": "2026-09-11T16:17:48.680Z",
  "executiveSummary": "Dolibarr 24.0.0 is susceptible to an authentication-required vulnerability within the sqlfilters API query parameter, allowing for unauthorized data exfiltration.\nThe vulnerability stems from an inconsistency between case-sensitive input validation and case-insensitive database column resolution.\nBy manipulating column names with uppercase variants, authenticated attackers can bypass denylist protections intended to block access to sensitive fields.\nThe flaw functions as a boolean-based SQL injection oracle, enabling attackers to systematically exfiltrate sensitive data, including password hashes, from the underlying database.\nThis impact extends to all user accounts, including administrative credentials, posing a critical risk to system integrity and confidentiality.\nExploitation requires active authentication but imposes no further specialized privileges, making it a significant vector for privilege escalation and unauthorized data access within the Dolibarr ecosystem.",
  "technicalDetails": "The vulnerability resides in the core library responsible for processing the sqlfilters API query parameter. The security mechanism utilizes a denylist to prevent users from querying sensitive database columns, such as those containing user credentials or hashed passwords.\nThe root cause is a mismatch in character casing handling between the application's input validation logic and the database management system. The application employs a case-sensitive check to validate field names against the restricted denylist. However, the underlying database resolves column names in a case-insensitive manner.\nAn authenticated attacker can exploit this discrepancy by supplying uppercase variants of restricted field names (e.g., 'PASSWORD' vs 'password'). The security filter fails to match the uppercase string against the lowercase denylist entry, allowing the request to proceed. Subsequently, the database engine treats the uppercase input as a valid reference to the restricted column.\nAttackers leverage this bypass to craft malicious SQL predicates. By utilizing prefix-matching functions—such as LIKE 'A%'—the attacker constructs a boolean-based oracle. By observing the HTTP response or application behavior based on whether the predicate is true or false, the attacker can iteratively infer the content of the protected fields.\nThe attack flow follows a sequential extraction process: 1) Authenticated user authenticates to the application; 2) User sends a crafted request to the sqlfilters API, employing an uppercase field name to bypass the denylist; 3) The request includes a boolean predicate (e.g., column LIKE 'admin_hash%'); 4) The application processes the query against the restricted database field; 5) The attacker observes the result to determine the validity of the guessed character; 6) This process repeats character-by-character to reconstruct the full contents of the protected field.\nThis vulnerability effectively facilitates the silent exfiltration of administrative password hashes, granting the attacker the potential to perform offline cracking and full system compromise. The flaw impacts Dolibarr 24.0.0 and is corrected in version 24.0.1, which mandates stricter normalization before validation."
}