CVE-2019-25710: Dolibarr ERP-CRM SQLi Vulnerability

CVE-2019-25710 Overview

Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary SQL queries. Attackers can inject malicious SQL code through the rowid POST parameter to extract sensitive database information using error-based SQL injection techniques.

Critical Impact

This SQL injection vulnerability enables unauthenticated attackers to extract sensitive data from the Dolibarr database, potentially compromising customer records, financial data, and administrative credentials stored within the ERP-CRM system.

Affected Products

• Dolibarr ERP-CRM version 8.0.4

Discovery Timeline

• 2026-04-12 - CVE CVE-2019-25710 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2019-25710

Vulnerability Analysis

This vulnerability is classified as CWE-89 (SQL Injection), a critical web application security flaw that occurs when user-supplied input is incorporated into SQL queries without proper sanitization or parameterization. In Dolibarr ERP-CRM 8.0.4, the dict.php administrative endpoint fails to properly validate or sanitize the rowid POST parameter before using it in database queries.

The attack is network-accessible and requires no authentication, making it particularly dangerous for internet-facing Dolibarr installations. Successful exploitation allows attackers to read, modify, or delete data within the database, potentially leading to full database compromise.

Root Cause

The root cause is improper input validation in the dict.php endpoint located in the admin directory. The rowid parameter is directly concatenated into SQL queries without proper escaping, prepared statements, or parameterized queries. This allows attackers to break out of the intended query context and inject arbitrary SQL commands.

Attack Vector

The vulnerability is exploited via network-based POST requests to the /admin/dict.php endpoint. An attacker crafts a malicious POST request containing SQL injection payloads in the rowid parameter. The attack leverages error-based SQL injection techniques, where database error messages are used to exfiltrate data character by character or in bulk.

The attacker sends specially crafted values in the rowid parameter that terminate the original query and append malicious SQL statements. Error messages returned by the application reveal database contents, allowing systematic extraction of sensitive information including user credentials, customer data, and configuration details.

Technical details and proof-of-concept information are available at Exploit-DB #46095 and the VulnCheck SQL Injection Advisory.

Detection Methods for CVE-2019-25710

Indicators of Compromise

• Unusual POST requests to /admin/dict.php containing SQL syntax characters such as single quotes, double dashes, UNION, SELECT, or OR statements
• Database error messages appearing in HTTP responses from the Dolibarr application
• Unexpected database queries or anomalous query patterns in database logs
• Evidence of data exfiltration or unauthorized database access in audit logs

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the rowid parameter
• Monitor HTTP access logs for suspicious requests targeting /admin/dict.php with encoded or plaintext SQL injection payloads
• Implement database query logging and alerting for anomalous query patterns or syntax errors
• Use intrusion detection systems (IDS) with signatures for SQL injection attack patterns

Monitoring Recommendations

• Enable verbose logging on the Dolibarr application to capture all POST parameters
• Configure database audit logging to track queries executed against sensitive tables
• Set up real-time alerts for failed SQL queries or database syntax errors originating from the web application
• Monitor for bulk data extraction patterns or unusual database read operations

How to Mitigate CVE-2019-25710

Immediate Actions Required

• Upgrade Dolibarr ERP-CRM to a version newer than 8.0.4 that addresses this SQL injection vulnerability
• Restrict access to the /admin/dict.php endpoint using network-level controls or authentication requirements
• Deploy WAF rules specifically blocking SQL injection attempts in POST parameters
• Review database logs for evidence of prior exploitation attempts

Patch Information

The vulnerable version 8.0.4 is available at SourceForge Dolibarr Download. Users should upgrade to the latest stable version available from the Dolibarr Official Website which includes security fixes for this and other vulnerabilities.

Workarounds

• Implement IP-based access restrictions to limit administrative endpoint access to trusted networks only
• Use a reverse proxy or WAF to filter and sanitize the rowid parameter before it reaches the application
• Disable or rename the vulnerable dict.php script if not required for operations
• Apply virtual patching through WAF rules until an official upgrade can be performed

# Example Apache .htaccess restriction for admin directory
<Directory "/var/www/dolibarr/htdocs/admin">
    Require ip 192.168.1.0/24
    Require ip 10.0.0.0/8
</Directory>