SQL Injection in Dolibarr ERP/CRM

Executive Summary

CVE-2026-58376 is a SQL injection vulnerability in Dolibarr versions up to 23.0.3 affecting multiple REST API list endpoints. The issue arises because the vulnerable endpoints use an outdated method to validate the sqlfilters parameter, which only checks for balanced parentheses but allows malicious SQL code, such as appended UNION SELECT statements, to be injected into the SQL WHERE clause unmodified.

This flaw enables authenticated API users, even those with low privileges, to exfiltrate arbitrary database contents including sensitive data like password hashes and API keys by supplying crafted malicious input to the sqlfilters parameter.

The vulnerability exists in four specific API endpoints related to setup dictionaries and multicurrencies, where the legacy validation method concatenates unmatched text directly into SQL queries without proper sanitization.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated API user to perform unauthorized data exfiltration from the Dolibarr database.

• Attackers can retrieve sensitive information such as user password hashes.
• API keys stored in the database can also be exposed.
• The breach of such sensitive data can lead to further compromise of the system and unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring API requests to the affected Dolibarr REST API endpoints for suspicious usage of the sqlfilters parameter, especially attempts to inject SQL clauses such as UNION SELECT.

Specifically, look for authenticated API calls to the following endpoints with unusual sqlfilters values:

• /api/index.php/setup/dictionary/regions
• /api/index.php/setup/dictionary/incoterms
• /api/index.php/setup/dictionary/vatrates
• /api/index.php/multicurrencies

You can use network monitoring tools or web server logs to filter requests containing the sqlfilters parameter with suspicious patterns such as unbalanced or appended SQL keywords.

Example commands to detect suspicious requests in web server logs (assuming Apache logs):

• grep -i 'sqlfilters' /var/log/apache2/access.log | grep -E 'UNION|SELECT|--|;|\bOR\b|\bAND\b'
• tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i 'sqlfilters'

Additionally, checking for unusual database queries or error logs related to these endpoints might help identify exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you should upgrade Dolibarr to a version that includes the fix from commit 14db36e or later.

The fix replaces the insecure legacy SQL filter validation method with a hardened function that properly validates and sanitizes the sqlfilters parameter, preventing SQL injection.

If upgrading immediately is not possible, consider restricting access to the affected API endpoints to trusted users only, and monitor for suspicious activity on these endpoints.

Also, review and limit API user permissions, especially for multicurrency read permissions, to reduce the risk of exploitation.

Finally, apply web application firewall (WAF) rules to detect and block SQL injection patterns targeting the sqlfilters parameter.

Useful 0 Not Useful 0