Blind SQL Injection Vulnerability in Dolibarr's WhatsApp Module

CVE-2026-76173

What is CVE-2026-76173?

A blind SQL injection vulnerability exists in the public endpoint 'public/webhook/receiver.php' of the WhatsApp module for Dolibarr version 1.9. This vulnerability arises from incorporating user-supplied data from the 'data.key.remoteJid' parameter into an SQL query without adequate escaping or parameterization. When the WHATSAPP_WEBHOOK_ALLOW feature is enabled, an unauthenticated attacker can manipulate this parameter to modify the SQL query. By exploiting this flaw, an attacker could execute a timing-based technique to extract sensitive information from the database, potentially leading to unauthorized access and service disruptions.

References