Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter
Dolibarr versions up to and including 23.0.0 are affected, including default installs from the official Docker image. Fixed in 22.0.5 and 23.0.2.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 22.0.5, 23.0.2
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Dolibarr versions up to and including 23.0.0 are affected Default installation is affected
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 27/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Dolibarr, an open-source ERP and CRM application, has an SQL injection flaw in its Third Party company update function. A remote attacker who has a low-privilege login with Third Party create or edit permission can read sensitive database contents, such as password hashes and API keys, or modify third-party records.
Read the original description
Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update functionality. The application concatenates the localtax1_value and localtax2_value properties into an SQL UPDATE statement without numeric conversion or other appropriate sanitization. An authenticated user with Third Party create or edit permission can submit crafted lt1 or lt2 POST parameters to read sensitive database information, including password hashes, API keys, and business data, or modify third-party records. This issue is fixed in versions 22.0.5 and 23.0.2.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach10/20Affects Packagist packages
- Severity8.8/10CVSS 8.8
- No patch0/5No signal
What would change the score
- Would score about 77 if added to CISA KEV
- Would score about 72 if CISA's SSVC rates exploitation active
- Would score about 34 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Dolibarr versions up to and including 23.0.0 are affected Default installation is affectedUpgrade to a fixed version: 22.0.5, 23.0.2.
Timeline
- CVE published
- Record last updated
- First seen by cve.now
Affected versions
- Dolibarr dolibarr
fixed in 22.0.5; From 23.0.0 · fixed in 23.0.2
- dolibarr/dolibarrPackagist
fixed in 22.0.5
- dolibarr/dolibarrPackagist
From 23.0.0 · fixed in 23.0.2
Evidence 7
- Advisory
- Repository
- Repository
- Repository
- Repository
Show all 7 sourcesShow fewer sources
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-33944
Is CVE-2026-33944 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
An authenticated user can use the localtax1_value parameter in societe/class/societe.class.php to inject SQL. This lets them read any data in the database, including password hashes and API keys, and modify records.Source: github.com, sec4check.pl
Which versions are affected by CVE-2026-33944?
dolibarr: before 22.0.5; from 23.0.0 before 23.0.2. dolibarr/dolibarr (Packagist): before 22.0.5. dolibarr/dolibarr (Packagist): from 23.0.0 before 23.0.2.Source: cve.now feed data
Am I affected, and how do I check?
Dolibarr versions up to and including 23.0.0 are listed as affected, and a default installation from the official Docker image is affected. To check a installation, look up the Dolibarr version it runs and compare it with the fixed versions 22.0.5 and 23.0.2.Source: github.com, sec4check.pl
How do I fix CVE-2026-33944?
Upgrade to Dolibarr 22.0.5 if you are on the 22 line, or to 23.0.2 if you are on the 23 line. No workaround is listed in the facts.Source: github.com, sec4check.pl