CVE-2026-76173: SQL Injection in WhatsApp for Dolibarr by Sgestion / EasySoft
Blind SQL injection vulnerability in the public endpoint public/webhook/receiver.php of the WhatsApp module for Dolibarr 1.9. The phone number value derived from the data.key.remoteJid parameter, received via a JSON request, is incorporated into an SQL query without escaping or parameterization. With the WHATSAPPWEBHOOKALLOW option enabled, an unauthenticated remote attacker could manipulate this parameter to alter the query. Exploitation using a timing-based technique could allow an attacker to extract information from the database and cause service disruption.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Instances running version 1.9 of the WhatsApp module for Dolibarr are exposed when the WHATSAPP_WEBHOOK_ALLOW option is enabled and the public webhook endpoint is reachable by an attacker.
Does exploitation require authentication or user interaction?
No. The vulnerable endpoint accepts a JSON request, and an unauthenticated remote attacker can supply a crafted data.key.remoteJid value when webhook access is allowed.
What could an attacker achieve?
A timing-based blind SQL injection could let an attacker extract information from the database. It may also cause service disruption.
What can be done if patching is not immediately possible?
Disable the WHATSAPP_WEBHOOK_ALLOW option to prevent unauthenticated use of the affected public webhook path.