This vulnerability exists in Dolibarr ERP CRM versions 23.0.0 through 23.0.2 within the _checkValForAPI function of the htdocs/expedition/class/expedition.class.php file, specifically in the Shipments API Endpoint. By manipulating the argument fields, an attacker can perform SQL injection remotely. The attack complexity is high, and no privileges or user interaction are required. The CVSS 4.0 vector indicates network attack vector, high complexity, low privileges, no user interaction, and low impact on confidentiality, integrity, and availability. The vendor has not issued a fix or advisory, and no patch links are available.

Successful exploitation could allow an attacker to execute unauthorized SQL commands on the backend database via the Shipments API Endpoint. However, the low CVSS score and high attack complexity suggest limited practical impact. There are no reports of active exploitation in the wild. The vulnerability could potentially lead to data exposure or modification but requires significant effort to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official Dolibarr channels for updates. Until a patch is available, consider restricting access to the Shipments API Endpoint or applying additional input validation and filtering at the application or network level to reduce exposure.