Summary
Dolibarr ERP CRM contains an SQL injection vulnerability in the third-party bankaccounts REST endpoint, where authenticated API users can influence the bank account type value. An attacker with the required company-creation permission may use this weakness to extract sensitive database information, including password hashes and API keys, through blind SQL queries.
Dolibarr ERP CRM contains an SQL injection vulnerability in the third-party bankaccounts REST endpoint, where authenticated API users can influence the bank account type value. An attacker with the required company-creation permission may use this weakness to extract sensitive database information, including password hashes and API keys, through blind SQL queries.
Affected context
The issue may occur in Dolibarr deployments where:
- The third-party bankaccounts REST endpoint is enabled
- Authenticated API users can access the endpoint
- The caller has the
societe/creerpermission - The
typefield reachesCompanyBankAccount::create()without effective parameterization or escaping
Risk depends on endpoint exposure, assigned permissions, database privileges, and the sensitivity of stored records.
The issue may occur in Dolibarr deployments where:
- The third-party bankaccounts REST endpoint is enabled
- Authenticated API users can access the endpoint
- The caller has the
societe/creerpermission - The
typefield reachesCompanyBankAccount::create()without effective parameterization or escaping
Risk depends on endpoint exposure, assigned permissions, database privileges, and the sensitivity of stored records.
Exploit preconditions
- Attack surface: Authenticated third-party bankaccounts REST API
- Required access: An API identity with the
societe/creerpermission - Trigger point: Processing the user-controlled
typefield during bank account creation - Why exploitation is possible: The value is incorporated into a database query without sufficient parameterization, allowing query logic to be altered and inferred through response timing
- Attack surface: Authenticated third-party bankaccounts REST API
- Required access: An API identity with the
societe/creerpermission - Trigger point: Processing the user-controlled
typefield during bank account creation - Why exploitation is possible: The value is incorporated into a database query without sufficient parameterization, allowing query logic to be altered and inferred through response timing
Why this happens
The vulnerability results from constructing or executing SQL with an input value that has not been safely parameterized. When the type field is treated as query syntax rather than as data, an authenticated caller may influence database operations and infer protected values. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL injection.
The vulnerability results from constructing or executing SQL with an input value that has not been safely parameterized. When the type field is treated as query syntax rather than as data, an authenticated caller may influence database operations and infer protected values. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL injection.
Potential impact
- An attacker may read password hashes or API keys from the database
- Sensitive business and customer information could be disclosed
- Database integrity could be affected if the vulnerable operation permits modification
- Compromised credentials could enable access to connected systems or integrations
- Application availability could be reduced through expensive or disruptive queries
- An attacker may read password hashes or API keys from the database
- Sensitive business and customer information could be disclosed
- Database integrity could be affected if the vulnerable operation permits modification
- Compromised credentials could enable access to connected systems or integrations
- Application availability could be reduced through expensive or disruptive queries
General mitigation guidance
Mitigation should focus on ensuring that all API-controlled values remain data throughout database processing.
Common defensive patterns include:
- Use parameterized queries or approved database abstraction methods for every query value
- Apply allowlist validation when fields such as account type have a defined set of valid values
- Avoid relying on escaping as the primary SQL injection defense
- Restrict API permissions according to least privilege and separate record creation from sensitive data access
- Limit database-account privileges available to the application
- Protect and rotate exposed secrets, including API keys, when disclosure is suspected
- Log anomalous query timing, repeated failed requests, and unusual bank account creation activity
Mitigation should focus on ensuring that all API-controlled values remain data throughout database processing.
Common defensive patterns include:
- Use parameterized queries or approved database abstraction methods for every query value
- Apply allowlist validation when fields such as account type have a defined set of valid values
- Avoid relying on escaping as the primary SQL injection defense
- Restrict API permissions according to least privilege and separate record creation from sensitive data access
- Limit database-account privileges available to the application
- Protect and rotate exposed secrets, including API keys, when disclosure is suspected
- Log anomalous query timing, repeated failed requests, and unusual bank account creation activity
How teams detect issues like this
Detection can include static analysis for string concatenation, interpolation, or formatting of SQL statements with request-derived values. Code review should examine REST handlers, model methods, and database helpers for missing parameter binding and for validation performed after query construction.
Runtime monitoring may flag repeated requests with unusual timing patterns, anomalous values in the type field, and unexpected access to credential-related records. CI policies can require parameterized database APIs and automated security review tools can help identify suspect query construction.
Detection can include static analysis for string concatenation, interpolation, or formatting of SQL statements with request-derived values. Code review should examine REST handlers, model methods, and database helpers for missing parameter binding and for validation performed after query construction.
Runtime monitoring may flag repeated requests with unusual timing patterns, anomalous values in the type field, and unexpected access to credential-related records. CI policies can require parameterized database APIs and automated security review tools can help identify suspect query construction.
