High · published December 15, 2025
🔥 A simple parameter is the key to a potentially devastating SQL injection flaw in Frappe ERPNext, allowing attackers to grab any database data they want! Think of it like a restaurant order form where a waiter takes your request without checking if the ingredients are safe or appropriate; if a sneaky customer writes 'poison' in the special requests, they might just get it! An attacker could exploit this vulnerability to extract any sensitive information stored in the database, such as user credentials or financial records. This could lead to data breaches, loss of trust, and even financial damage to the organization. It's absolutely critical to address this to protect your essential data!
Think of it like a restaurant order form where a waiter takes your request without checking if the ingredients are safe or appropriate; if a sneaky customer writes 'poison' in the special requests, they might just get it! This SQL injection vulnerability is found in the get_outstanding_reference_documents() function at erpnext/accounts/doctype/payment_entry/payment_entry.py, where the to_posting_date parameter is interpolated into the SQL query without proper sanitization, allowing arbitrary SQL payloads to be executed.
An attacker could exploit this vulnerability to extract any sensitive information stored in the database, such as user credentials or financial records. This could lead to data breaches, loss of trust, and even financial damage to the organization. It's absolutely critical to address this to protect your essential data! Patch to version 15.89.1 or later immediately to close this security hole. Ensure all SQL parameters are properly sanitized and consider implementing prepared statements for safer query execution. Don't leave your database open to prying eyes! You've got this! Take these steps to secure your Frappe ERPNext installation and keep your data safe. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| frappe/erpnext | ≤ 15.89.0 | — |