Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dolibarr/dolibarr | composer | < 22.0.5 | 22.0.5 |
| dolibarr/dolibarr | composer | >= 23.0.0, < 23.0.2 | 23.0.2 |
Miggo AIRoot Cause AnalysisCVE-2026-33944 is a SQL injection in Dolibarr's third-party (company) update flow. The root cause is that the localtax1_value (POST parameter lt1) and localtax2_value (POST parameter lt2) fields are read via GETPOST('lt1', 'alpha') in htdocs/societe/card.php and assigned to the Societe object without numeric casting. Inside Societe::update() (in htdocs/societe/class/societe.class.php), these values are concatenated directly into the SQL UPDATE statement: $sql .= ",localtax1_value =".$this->localtax1_value; (line 1672) and $sql .= ",localtax2_value =".$this->localtax2_value; (line 1682). Because the injection point is in a numeric SQL context (no surrounding quotes) and the alpha filter does not strip single quotes, parentheses, commas, or SQL keywords, an authenticated user with "Third Party: Create/Edit" permission can inject arbitrary SQL (e.g., lt1=1,note_private=(SELECT pass_crypted FROM llx_user WHERE rowid=1)). The adjacent localtax1_assuj/localtax2_assuj fields are correctly cast to (int), confirming the developers were aware of the risk but missed these two value fields. The vulnerable function that would appear in a runtime profile during exploitation is Societe::update(), which is the method that builds and executes the vulnerable UPDATE query. The input-reading code in card.php is procedural (not a class method) and is the source of the tainted value, but the actual SQL injection sink is Societe::update().
Societe::updatehtdocs/societe/class/societe.class.php