High · published December 15, 2025
🚨 Just when you thought your payment system was safe, a sneaky SQL injection vulnerability in Frappe ERPNext can let attackers waltz in and extract sensitive data! 🔥 Think of it like a restaurant where a chef accepts any customer order without checking the ingredients—an SQL payload slips in, and suddenly, the entire kitchen's secrets are laid bare. 🍽️ This vulnerability could allow attackers to steal sensitive information from your database, potentially exposing customer data, financial records, or trade secrets. The consequences could be absolutely devastating, leading to serious financial and reputational damage. 😱
Think of it like a restaurant where a chef accepts any customer order without checking the ingredients—an SQL payload slips in, and suddenly, the entire kitchen's secrets are laid bare. 🍽️ The vulnerability exists in the function get_outstanding_reference_documents() where the from_posting_date parameter is directly interpolated into the SQL query without proper sanitization, making it ripe for SQL injection attacks.
This vulnerability could allow attackers to steal sensitive information from your database, potentially exposing customer data, financial records, or trade secrets. The consequences could be absolutely devastating, leading to serious financial and reputational damage. 😱 Immediately patch your Frappe ERPNext installation to version 15.89.1 or later to close this critical vulnerability. Additionally, ensure proper parameter binding and input sanitization in your SQL queries to prevent future exploits. 🔧🛡️ You've got this! Apply the patch and tighten your security—your data deserves the best protection! 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| frappe/erpnext | ≤ 15.89.0 | — |