CVE-2026-33944

Summary

A SQL injection flaw exists in Dolibarr's third-party company update functionality due to unsanitized concatenation of user-controlled 'lt1' and 'lt2' POST parameters into an SQL UPDATE statement, allowing authenticated attackers with edit permissions to read sensitive data or modify records.

Exploitability

Exploitation requires valid authentication and third-party edit permissions, making it accessible to compromised or low-privilege accounts.

Blast radius

Successful exploitation could lead to full database compromise, exposing password hashes, API keys, and business-critical third-party data.

Detection

Look for SQL syntax errors or unexpected patterns in web server access logs for requests to the third-party update endpoint containing non-numeric values in 'lt1' or 'lt2' POST parameters; also monitor for anomalous database query logs showing UPDATE statements with string literals in numeric fields.

Prioritized remediation

Upgrade to Dolibarr version 22.0.5 or 23.0.2 (or later) to patch the SQL injection vulnerability in the third-party update endpoint.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.