CVE-2026-76173

Blind SQL injection vulnerability in the public endpoint public/webhook/receiver.php of the WhatsApp module for Dolibarr 1.9. The phone number value derived from the data.key.remoteJid parameter, received via a JSON request, is incorporated into an SQL query without escaping or parameterization. With the WHATSAPP_WEBHOOK_ALLOW option enabled, an unauthenticated remote attacker could manipulate this parameter to alter the query. Exploitation using a timing-based technique could allow an attacker to extract information from the database and cause service disruption.