CVE-2026-76173— SQL Injection in WhatsApp for Dolibarr by Sgestion / EasySoft

Quick assessment

Affected

Sgestion / EasySoft WhatsApp for Dolibarr

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Dolibarr 1.9 的 WhatsApp 模块在公开端点中存在盲注 SQL 注入漏洞。该漏洞源于从 JSON 请求中接收的参数所提取的电话号码值，在未进行转义或参数化处理的情况下被直接拼接到 SQL 查询中。当启用选项时，未经身份验证的远程攻击者可篡改该参数以修改查询语句。利用基于时间延迟的注入技术，攻击者能够从数据库中窃取信息并导致服务中断。

CVSS 8.8 · High Updated Nov 12, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SQL Injection in WhatsApp for Dolibarr by Sgestion / EasySoft

Source: CVE Program / CVE List V5

Vulnerability Description

Blind SQL injection vulnerability in the public endpoint `public/webhook/receiver.php` of the WhatsApp module for Dolibarr 1.9. The phone number value derived from the `data.key.remoteJid` parameter, received via a JSON request, is incorporated into an SQL query without escaping or parameterization. With the WHATSAPP_WEBHOOK_ALLOW option enabled, an unauthenticated remote attacker could manipulate this parameter to alter the query. Exploitation using a timing-based technique could allow an attacker to extract information from the database and cause service disruption.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Sgestion / EasySoft	WhatsApp for Dolibarr	1.9	-

II. Public POCs for CVE-2026-76173

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-76173

请登录查看更多情报信息。

Other References for CVE-2026-76173 (1)

https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-whatsapp-dolibarr-sgestion-easysoft

https://www.cve.org/CVERecord?id=CVE-2026-76173

IV. Related Vulnerabilities

Same weakness: CWE-89