Dolibarr ERP CRM SQL Injection Vulnerability in Shipments API Endpoint

A SQL injection vulnerability has been identified in Dolibarr ERP CRM versions prior to 23.0.2. The issue arises in the Shipments API Endpoint, specifically within the _checkValForAPI function of the expedition.class.php file. The vulnerability allows remote attackers to manipulate argument fields, leading to SQL injection. Although the exploit is publicly available, it requires a high degree of complexity to execute.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.