Dolibarr versions prior to 24.0.0 allow a user with import rights to inject arbitrary SQL through the CSV or XLSX import wizard. The import routine applies only an informal alphanohtml filter to the update keys, leaving SQL syntax intact. The crafted input causes the framework to build a WHERE clause that includes the attacker‑supplied payload, executing it via the database driver. The injected query can retrieve arbitrary table contents and, because the import logic uses the result of the SELECT as a target row, the attacker can overwrite or redirect the database update. The flaw is a classic Insecure Direct Object Reference/SQL Injection issue that could be exploited by any authenticated importer. It bypasses the usual column validation because the server never verifies that the submitted keys match the predetermined list presented to the user. Risk is elevated by the lack of an EPSS score but the high CVSS of 8.6 indicates severe impact. The vulnerability is not listed in CISA KEV, suggesting no publicly known exploits yet, but the attack path requires only a valid Dolibarr account with import permission, which is a common role. Once exploited, an attacker could read sensitive data and modify critical records.

Dolibarr ERP/CRM installations running any release older than version 24.0.0. The flaw is present in the 23.x branch, including 23.0.4, which does not contain the fix. The impact covers modules that rely on the CSV/XLSX import wizard, providing SQL injection and unauthorized record modification capabilities.

The CVSS score of 8.6 classifies this as a high‑severity flaw. Although the EPSS score is not provided, the lack of a known exploit in CISA KEV does not diminish the intrinsic risk, as any authenticated user with import rights can exercise the vulnerability. An attacker can manipulate the import wizard to inject arbitrary SQL, leading to data exfiltration and unauthorized record modification. The attack can be performed remotely via the web interface if the attacker has valid Dolibarr credentials and permissions.