Dolibarr ERP CRM versions up to 23.0.2 contain a SQL injection flaw in the _checkValForAPI function of the Shipments API endpoint. By manipulating the argument fields sent to this API, a remote attacker could inject SQL commands into the backend database. The flaw is based on improper handling of user input, leading to a traditional injection weakness (CWE‑89) and a related input validation issue (CWE‑74). Successful exploitation would allow the attacker to read, modify or delete data in the Dolibarr database, compromising confidentiality, integrity and potentially availability of business data.

The affected product is Dolibarr ERP CRM, with versions up to 23.0.2 vulnerable to the described SQL injection flaw. No specific patches or remediations were provided by the vendor, and the vendor did not respond to the disclosure.

The CVSS score of 2.3 indicates a low severity overall, and the EPSS score is not available, suggesting limited automation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitability is reported as difficult, yet the vulnerability is publicly available. The likely attack vector is remote, via the exposed Shipments API endpoint, and would require a high level of complexity to craft a successful SQL injection payload. In the absence of an official fix, the risk remains contingent on whether an attacker offloads a suitable payload through the API and exploits the database directly.