Cyber Resilience

CVE-2019-25450

HighPublic PoC

Published: 22 February 2026

Published
22 February 2026
Modified
02 March 2026
KEV Added
Patch
CVSS Score v4 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0005 17.2th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25450 is a high-severity SQL Injection (CWE-89) vulnerability in Dolibarr Dolibarr Erp\/Crm. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2019-25450 affects Dolibarr ERP/CRM version 10.0.1 and consists of multiple SQL injection vulnerabilities (CWE-89). These flaws exist in card.php endpoints, where POST parameters such as actioncode, demand_reason_id, and availability_id are vulnerable to SQL code injection due to insufficient input sanitization.

The vulnerabilities carry a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network accessibility, low attack complexity, no privileges or user interaction required, and high confidentiality impact. Although the description specifies authenticated attackers, the CVSS vector suggests no authentication is needed. Exploiters can manipulate database queries remotely to extract sensitive information using boolean-based blind, error-based, and time-based blind techniques.

References include an Exploit-DB entry (https://www.exploit-db.com/exploits/47370) providing proof-of-concept exploits and a Vulncheck advisory (https://www.vulncheck.com/advisories/dolibarr-erpcrm-sql-injection-via-cardphp) detailing the issues in card.php. Security practitioners should review these for specific mitigation steps, such as applying patches or input validation updates from Dolibarr maintainers.

EU & UK References

Vulnerability details

Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through POST parameters. Attackers can inject malicious SQL through parameters like actioncode, demand_reason_id, and availability_id in card.php endpoints to extract…

more

sensitive database information using boolean-based blind, error-based, and time-based blind techniques.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

SQL injection in public-facing Dolibarr web app directly enables remote exploitation for data access per T1190.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2019-25710Same product: Dolibarr Dolibarr Erp\/Crm
CVE-2019-25452Same product: Dolibarr Dolibarr Erp\/Crm
CVE-2026-23500Same product: Dolibarr Dolibarr Erp\/Crm
CVE-2026-22666Same product: Dolibarr Dolibarr Erp\/Crm
CVE-2024-55227Same product: Dolibarr Dolibarr Erp\/Crm
CVE-2026-31018Same product: Dolibarr Dolibarr Erp\/Crm
CVE-2026-31019Same product: Dolibarr Dolibarr Erp\/Crm
CVE-2018-25357Same product: Dolibarr Dolibarr Erp\/Crm
CVE-2025-67486Same product: Dolibarr Dolibarr Erp\/Crm
CVE-2025-56588Same product: Dolibarr Dolibarr Erp\/Crm

Affected Assets

dolibarr
dolibarr erp\/crm
10.0.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly addresses insufficient input sanitization in POST parameters like actioncode, demand_reason_id, and availability_id by requiring validation to block SQL injection payloads.

prevent

Mitigates the specific SQL injection flaws in Dolibarr ERP/CRM 10.0.1 card.php endpoints through timely identification, reporting, and correction via patching.

preventdetect

Boundary protection with web application firewalls inspects and blocks malicious SQL payloads in network traffic to vulnerable card.php endpoints.

References