Threats tagged 'ghsa-rvwr-q5hj-wq7g'

Dolibarr ERP CRM versions up to 23.0.2 contain a SQL injection vulnerability in the Shipments API Endpoint. The flaw exists in the _checkValForAPI function of htdocs/expedition/class/expedition.class.php and can be exploited remotely with a high attack complexity. Exploit code is publicly available, but the vendor has not responded to the disclosure and no patch is currently known.