Dolibarr ERP‑CRM version 8.0.4 contains an SQL injection flaw in the rowid parameter of the admin dict.php endpoint. The input is not validated, allowing attackers to inject and execute arbitrary SQL statements via a POST request. This can expose sensitive database information such as user credentials, financial records, or any other tables accessible to the database user. The weakness is a classic SQL injection (CWE‑89).

Dolibarr ERP‑CRM version 8.0.4 is affected. No other versions are listed as impacted in the available data.

The severity score of 8.8 classifies the vulnerability as high risk. No EPSS information is available, and it is not included in the CISA KEV catalog. The likely attack path involves a web‑based POST request to the admin dict.php endpoint, which normally requires administrator authentication. If an attacker gains access to the administrative interface, they can inject malicious SQL through error‑based techniques and retrieve or manipulate sensitive data. Proper access control and input validation are crucial to mitigate this risk.