CVE-2019-25710: SQL Injection in Dolibarr ERP-CRM

The SQL injection vulnerability in Dolibarr ERP-CRM allows an attacker to manipulate database queries through the rowid parameter in the dict.php endpoint. Successful exploitation could enable attackers to extract sensitive information such as user credentials, financial data, customer details, and other confidential business records. Depending on database permissions, an attacker might even be able to modify or delete data, leading to significant operational disruption and data loss. The attack leverages error-based SQL injection techniques, making it potentially easier to exploit than blind SQL injection.

1. Reserved2026-04-12
2. Published2026-04-12
3. EPSS updated2026-04-20

The primary mitigation for CVE-2019-25710 is to upgrade Dolibarr ERP-CRM to a patched version. Consult the Dolibarr documentation for the latest recommended version and upgrade instructions. If upgrading immediately is not feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious SQL syntax in the rowid parameter of the dict.php endpoint. Input validation and sanitization on the server-side can also help prevent SQL injection attacks. Regularly review database user permissions to minimize the potential impact of a successful exploit.