Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter
High · CVSS 8.8 (GHSA) · fetched 2026-10-27
### Summary A SQL Injection vulnerability exists in the Third Party (Company) update functionality of Dolibarr ERP/CRM. The `localtax1_value` parameter (`lt1`) is concatenated directly into an SQL UPDATE statement in `societe/class/societe.class.php` at line 1672 without any escaping, type casting, or parameterized query binding. An authenticated user with standard "Third Party: Create/Edit" permission can extract any data from the database, including password hashes, API keys, and all business data.
Remediation
No patched version is listed in the advisory yet — follow the source advisory for mitigations and updates.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-27T10:20:12-04:00 · https://github.com/advisories/GHSA-v5fq-cf5m-vwv7