Dolibarr ERP/CRM version 23.0.0 and earlier contains a SQL Injection vulnerability in the Third Party update functionality. The vulnerability arises from the localtax1_value (lt1) and localtax2_value (lt2) parameters being concatenated directly into an SQL UPDATE statement without proper sanitization or parameterization. An authenticated user with standard 'Third Party: Create/Edit' permissions can exploit this flaw to read and modify any database data, including sensitive information such as password hashes and API keys. The vulnerability allows injection of arbitrary SQL expressions, enabling data exfiltration and potential privilege escalation. The default unsalted MD5 password hashes facilitate cracking and admin account takeover. No official patch information is provided in the input data.