Blind SQL injection vulnerability in the public endpoint "public/webhook/receiver.php" of the WhatsApp module for Dolibarr 1.9. The phone number value derived from the "data.key.remoteJid" parameter, received via a JSON request, is incorporated into an SQL query without escaping or parameterization. With the WHATSAPP_WEBHOOK_ALLOW option enabled, an unauthenticated remote attacker could manipulate this parameter to alter the query. Exploitation using a timing-based technique could allow an attacker to extract information from the database and cause service disruption.