CVE-2019-25450
Published: 22 February 2026
Summary
CVE-2019-25450 is a high-severity SQL Injection (CWE-89) vulnerability in Dolibarr Dolibarr Erp\/Crm. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 16.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
NVD Description
Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through POST parameters. Attackers can inject malicious SQL through parameters like actioncode, demand_reason_id, and availability_id in card.php endpoints to extract…
more
sensitive database information using boolean-based blind, error-based, and time-based blind techniques.
Deeper analysisAI
CVE-2019-25450 affects Dolibarr ERP/CRM version 10.0.1 and consists of multiple SQL injection vulnerabilities (CWE-89). These flaws exist in card.php endpoints, where POST parameters such as actioncode, demand_reason_id, and availability_id are vulnerable to SQL code injection due to insufficient input sanitization.
The vulnerabilities carry a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network accessibility, low attack complexity, no privileges or user interaction required, and high confidentiality impact. Although the description specifies authenticated attackers, the CVSS vector suggests no authentication is needed. Exploiters can manipulate database queries remotely to extract sensitive information using boolean-based blind, error-based, and time-based blind techniques.
References include an Exploit-DB entry (https://www.exploit-db.com/exploits/47370) providing proof-of-concept exploits and a Vulncheck advisory (https://www.vulncheck.com/advisories/dolibarr-erpcrm-sql-injection-via-cardphp) detailing the issues in card.php. Security practitioners should review these for specific mitigation steps, such as applying patches or input validation updates from Dolibarr maintainers.
Details
- CWE(s)