SQL Injection in WhatsApp for Dolibarr by Sgestion / EasySoft
WhatsApp for Dolibarr, version 1.9.
INCIBE has coordinated the disclosure of a high severity vulnerability affecting WhatsApp for Dolibarr by Sgestion / EasySoft, a third-party module that integrates WhatsApp messaging into Dolibarr. The vulnerability was discovered by Gabriel Jesús Machado Tavares.
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector, and CWE vulnerability type:
- CVE-2026-76173: CVSS v4.0: 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N | CWE-89
The manufacturer has confirmed that the patch addressing the vulnerability has already been deployed.
CVE-2026-76173: blind SQL injection vulnerability in the public endpoint `public/webhook/receiver.php` of the WhatsApp module for Dolibarr 1.9. The phone number value derived from the `data.key.remoteJid` parameter, received via a JSON request, is incorporated into an SQL query without escaping or parameterization. With the WHATSAPP_WEBHOOK_ALLOW option enabled, an unauthenticated remote attacker could manipulate this parameter to alter the query. Exploitation using a timing-based technique could allow an attacker to extract information from the database and cause service disruption.
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-76173 | Alta | No | SGESTION / EASYSOFT |
