CVE-2018-3884: SQL Injection
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The sortby and start parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-3884?
CVE-2018-3884 is considered a critical severity vulnerability due to its potential for SQL injection and data compromise.
How do I fix CVE-2018-3884?
To fix CVE-2018-3884, upgrade ERPNext to version 10.1.7 or later, where the vulnerability has been patched.
What type of attack is associated with CVE-2018-3884?
CVE-2018-3884 is associated with SQL injection attacks which can manipulate database queries through crafted web requests.
Which version of ERPNext is affected by CVE-2018-3884?
CVE-2018-3884 affects ERPNext version 10.1.6 and possibly earlier versions.
Can CVE-2018-3884 lead to data compromise?
Yes, exploitation of CVE-2018-3884 can lead to unauthorized access and compromise of sensitive data within the ERPNext application.