LiveActive security incident?Get immediate response
CVE Record

CVE-2018-16809: An issue was discovered in Dolibarr through 7.0.0.

An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and value_unit.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2018-16809 is a SQL injection issue in Dolibarr expense reports through version 7.0.0. The available record does not provide CVSS, authentication requirements, confirmed exploitation, or a named fixed version, so organizations should first confirm whether older Dolibarr instances remain in use.

Executive priority

Prioritize discovery and remediation planning if Dolibarr is used, especially for internet-facing or sensitive financial workflows. Because patch and exploit evidence is incomplete in the provided sources, urgency should be driven by confirmed exposure and business data sensitivity.

Technical view

The CVE description identifies expensereport/card.php in Dolibarr's expense reports module as accepting unsafe integer parameters, specifically qty and value_unit, resulting in SQL injection. The source bundle does not include exploit status, patch details, CWE classification, or affected CPE data beyond Dolibarr through 7.0.0.

Likely exposure

Exposure is most likely where Dolibarr version 7.0.0 or earlier is deployed and the expense reports module is reachable by users. Public internet exposure, authentication requirements, and privilege prerequisites are not established in the provided sources.

Exploitation context

The CVE is not listed as KEV in the supplied bundle, and no cited source confirms active exploitation. SQL injection can affect confidentiality and integrity, but the available evidence does not define practical exploitability or impact boundaries.

Researcher notes

The source data is thin: no CVSS vector, CPEs, CWE, exploit confirmation, or explicit fix are provided. Treat the description and GitHub issue as the grounding facts, and avoid assuming authentication state or vulnerable code paths beyond the named file and parameters.

Mitigation direction

  • Inventory Dolibarr deployments and identify any versions through 7.0.0.
  • Check Dolibarr vendor guidance and the referenced GitHub issue for fixed release information.
  • Upgrade affected Dolibarr instances to a vendor-supported fixed version when confirmed.
  • Restrict access to expense report functionality until remediation is complete.
  • Monitor application and database logs for suspicious expense report activity.

Validation and detection

  • Confirm whether Dolibarr is present and record exact application versions.
  • Determine whether the expense reports module is enabled and reachable.
  • Review access controls for users who can reach expense report pages.
  • Check logs for unusual requests involving expensereport/card.php parameters.
  • Verify remediation against vendor guidance after any upgrade or configuration change.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-16809 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.