CVE-2018-3883: SQL Injection
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The employee and sortorder parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-3883?
CVE-2018-3883 is classified as a critical vulnerability due to its potential for data compromise through SQL injection.
How do I fix CVE-2018-3883?
To address CVE-2018-3883, upgrade ERPNext to the latest version that resolves SQL injection issues.
Which versions of ERPNext are affected by CVE-2018-3883?
CVE-2018-3883 specifically affects ERPNext version 10.1.6.
What impact can CVE-2018-3883 have if exploited?
If exploited, CVE-2018-3883 can lead to unauthorized access and manipulation of the database contents due to SQL injection.
Who is at risk of CVE-2018-3883?
Organizations using ERPNext version 10.1.6 are at risk of CVE-2018-3883 if they do not apply the necessary security patches.