PT-2026-21435 · Unknown · Dolibarr Erp/Crm

Published 2026-02-22 · Updated 2026-02-25 · CVE-2019-25450

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM version 10.0.1

Description The software contains multiple SQL injection flaws. Authenticated attackers can manipulate database queries by injecting SQL code through POST parameters. Attackers can inject malicious SQL through parameters like actioncode, demand reason id, and availability id in the /card.php API endpoint to extract sensitive database information using boolean-based blind, error-based, and time-based blind techniques.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /card.php endpoint to minimize the risk of exploitation. Avoid using the parameters actioncode, demand reason id, and availability id in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-25450

Affected Products

Dolibarr Erp/Crm

References · 9

• 🔥 https://exploit-db.com/exploits/47370 · Exploit
• https://cve.org/CVERecord?id=CVE-2019-25450 · Security Note
• https://ubuntu.com/security/CVE-2019-25450 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25450 · Security Note
• https://osv.dev/vulnerability/CVE-2019-25450 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-25450 · Vendor Advisory
• https://t.me/cveNotify/153218 · Telegram Post
• https://vulncheck.com/advisories/dolibarr-erpcrm-sql-injection-via-cardphp · Note
• https://t.me/CVEtracker/45442 · Telegram Post