This vulnerability affects the _checkValForAPI function in the file htdocs/expedition/class/expedition.class.php of Dolibarr ERP CRM up to version 23.0.2. It allows remote attackers to perform SQL injection by manipulating the argument fields passed to the Shipments API Endpoint. The attack complexity is high, and no privileges or user interaction are required. The CVSS 4.0 base score is 2.3, indicating low severity. The vendor has not provided a patch or advisory, and the exploit code is publicly accessible.

Successful exploitation could allow an attacker to execute unauthorized SQL commands on the backend database via the Shipments API Endpoint. Given the low CVSS score and high attack complexity, the impact is limited but could potentially lead to unauthorized data access or modification within the ERP CRM system. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the Shipments API Endpoint and apply compensating controls such as input validation and monitoring for suspicious activity. Stay alert for any future vendor updates or patches.