A blind SQL injection vulnerability exists in the public endpoint public/webhook/receiver.php of the WhatsApp module for Dolibarr version 1.9. The vulnerability arises because the phone number value from the data.key.remoteJid JSON parameter is used in an SQL query without proper escaping or parameterization. When the WHATSAPP_WEBHOOK_ALLOW option is enabled, an unauthenticated attacker can exploit this flaw using timing-based techniques to extract database information and potentially disrupt service.