CVE-2018-10094: Dolibarr SQL injection via unquoted integer parameters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, and public exploit code plus very high EPSS make this an urgent patch target.

What it is

Dolibarr before 7.0.2 contains a SQL injection flaw reachable through integer parameters that are not wrapped in quotes. A remote attacker can inject arbitrary SQL commands, and the flaw carries a CVSS 3.0 base score of 9.8 (critical).

Impact

An attacker can execute arbitrary SQL commands against the Dolibarr database, potentially reading, modifying or deleting data and, depending on database privileges, further compromising the host.

Attack surface

The vector is network-reachable with no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), so the vulnerable integer parameters can be hit directly over HTTP. No authentication is required per the CVSS vector.

Exploitation

Public exploit references exist (Exploit-DB 44805 and vendor advisory tagged Exploit), and EPSS is 0.70729 (99.36th percentile), indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Upgrade Dolibarr to 7.0.2 or later, applying the referenced patch commit.
• If immediate upgrade is not possible, restrict network access to the Dolibarr instance to trusted users and networks.
• Review and harden database account privileges used by Dolibarr to limit blast radius.
• Audit application code paths that pass integer parameters to SQL queries and enforce parameterized queries.

Detection

• Monitor web and database logs for SQL syntax errors or anomalous query patterns against Dolibarr endpoints.
• Alert on requests containing SQL metacharacters in integer parameters to Dolibarr paths.
• Review database audit logs for unexpected SELECT, UNION or stacked queries originating from the web application account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.