CVE-2018-3882: SQL Injection
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The searchfield parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-3882?
CVE-2018-3882 is considered a high-severity vulnerability due to its potential for data compromise through SQL injection.
How do I fix CVE-2018-3882?
To fix CVE-2018-3882, upgrade ERPNext to version 10.1.7 or later, where the vulnerability has been patched.
What is the impact of exploiting CVE-2018-3882?
Exploiting CVE-2018-3882 can lead to unauthorized access to sensitive data due to SQL injection attacks.
Which versions of ERPNext are affected by CVE-2018-3882?
CVE-2018-3882 specifically affects ERPNext version 10.1.6.
Can CVE-2018-3882 be exploited remotely?
Yes, CVE-2018-3882 can be exploited remotely by sending specially crafted web requests that target the vulnerable searchfield parameter.