CVE-2019-25450
Published: 22 February 2026
Summary
CVE-2019-25450 is a high-severity SQL Injection (CWE-89) vulnerability in Dolibarr Dolibarr Erp\/Crm. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25450 affects Dolibarr ERP/CRM version 10.0.1 and consists of multiple SQL injection vulnerabilities (CWE-89). These flaws exist in card.php endpoints, where POST parameters such as actioncode, demand_reason_id, and availability_id are vulnerable to SQL code injection due to insufficient input sanitization.
The vulnerabilities carry a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network accessibility, low attack complexity, no privileges or user interaction required, and high confidentiality impact. Although the description specifies authenticated attackers, the CVSS vector suggests no authentication is needed. Exploiters can manipulate database queries remotely to extract sensitive information using boolean-based blind, error-based, and time-based blind techniques.
References include an Exploit-DB entry (https://www.exploit-db.com/exploits/47370) providing proof-of-concept exploits and a Vulncheck advisory (https://www.vulncheck.com/advisories/dolibarr-erpcrm-sql-injection-via-cardphp) detailing the issues in card.php. Security practitioners should review these for specific mitigation steps, such as applying patches or input validation updates from Dolibarr maintainers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19602
Vulnerability details
Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through POST parameters. Attackers can inject malicious SQL through parameters like actioncode, demand_reason_id, and availability_id in card.php endpoints to extract…
more
sensitive database information using boolean-based blind, error-based, and time-based blind techniques.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing Dolibarr web app directly enables remote exploitation for data access per T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses insufficient input sanitization in POST parameters like actioncode, demand_reason_id, and availability_id by requiring validation to block SQL injection payloads.
Mitigates the specific SQL injection flaws in Dolibarr ERP/CRM 10.0.1 card.php endpoints through timely identification, reporting, and correction via patching.
Boundary protection with web application firewalls inspects and blocks malicious SQL payloads in network traffic to vulnerable card.php endpoints.