CVE-2025-66439
BaseFortify
Publication date: 2025-12-15
Last updated on: 2025-12-16
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| frappe | erpnext | 15.89.0 |
| frappe | frappe | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a SQL Injection issue in the Frappe ERPNext software, specifically in the function get_outstanding_reference_documents(). It occurs because the from_posting_date parameter is directly inserted into an SQL query without proper sanitization or parameter binding. This allows an attacker to inject malicious SQL code to extract arbitrary data from the database. [1]
How can this vulnerability impact me? :
The vulnerability can allow an attacker to access unauthorized data from the database, potentially leading to data breaches, data manipulation, or other harmful database-related attacks within applications using the Frappe Framework like ERPNext. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the Frappe Framework and ERPNext to versions that have patched the SQL Injection issue in the get_outstanding_reference_documents() function. Additionally, avoid using untrusted input directly in SQL queries and apply proper input validation and parameter binding. Follow the Frappe security guidelines and monitor their GitHub security advisories for patches and updates. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this SQL Injection vulnerability in Frappe ERPNext affects compliance with common standards and regulations such as GDPR or HIPAA.