CVE-2026-78804_Dolibarr_authenticated_SQL_injection

The action responsible for setting the per-warehouse stock alert threshold (`seuil_stock_alerte`) accepts user-controlled input and later incorporates it into an SQL query without proper numeric casting or parameter binding. #dolibarr #exploit

It subsequently reaches an SQL statement through direct string concatenation:

Because the value is inserted into an unquoted numeric context, an SQL expression can be supplied instead of a regular numeric value.

Time-based Blind SQL Injection

A boolean/time-based expression is sufficient to demonstrate execution:

Example parameter:

A successful request produces an HTTP response delay of approximately 15 seconds, confirming evaluation of the injected SQL expression.

Vulnerable Request

The vulnerable action can be reached with an authenticated request similar to:

Requirements:

• Valid authenticated session
• CSRF token (extracted from product card page)
• Product ID
• Warehouse ID

Authentication & Privileges

The issue was reproduced with an authenticated account having only:

permission — a low-privilege account that can create products.

Impact

The SQL injection enables:

1. Blind time-based SQL injection — queries can be executed via SLEEP delays
2. Information disclosure — database contents can be exfiltrated character-by-character
3. Potential privilege escalation — admin credentials or sensitive data extraction
4. Database reconnaissance — schema enumeration via error or time-based methods

Database-level constraints on this system prevented direct OS command execution.

Exploit Tool

The accompanying PoC script stock_sqli_poc.py automates the exploitation process:

Usage

Features

• Automatic login — authenticates to the target
• Injection confirmation — validates SQL injection with test payloads (1=1 vs 1=2)
• Binary search extraction — efficiently extracts data character-by-character using ASCII comparison
• Proxy support — integrates with Burp Suite or other HTTP proxies
• Configurable delay — adjusts SLEEP duration for reliability

Command-line Options

Extraction Examples

Extract admin password hash:

Enumerate users:

Database version:

Current database user:

⚠️ Legal Notice: Use this exploit only against systems for which you have explicit written authorization. Unauthorized access to computer systems is illegal. This PoC is provided for educational and authorized security testing purposes only.