Dolibarr vulnerable to unauthenticated database access

HIGH 7.5CVE-2023-33568 · BIT-dolibarr-2023-33568 · GHSA-fpvg-m786-h5vr · Published 13/06/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
dolibarr/dolibarr Packagist	`≥ 16.0.0, < 16.0.5`	`16.0.5`
dolibarr erp/crm dolibarr	`≥ 16.0.0, < 16.0.5`	`16.0.5`

Description

An issue in Dolibarr v16.0.0 to v16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.

NVD description

An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.

References

nvd.nist.gov/vuln/detail/CVE-2023-33568 · ADVISORY
Dolibarr/dolibarr commit bb7b69e · WEB
Dolibarr/dolibarr commit be82f51 · WEB
Dolibarr/dolibarr · PACKAGE
dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471 · WEB
dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471/1 · WEB
dsecbypass.com/en/dolibarr-pre-auth-contact-database-dump · WEB
dsecbypass.com/en/dolibarr-pre-auth-contact-database-dump · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free