CVE-2018-3885: SQL Injection
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The orderby parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required.
Affected Software
Event History
Frequently Asked Questions
What severity level is CVE-2018-3885?
CVE-2018-3885 has a high severity level due to its potential for data compromise via SQL injection.
How do I fix CVE-2018-3885?
To fix CVE-2018-3885, upgrade ERPNext to a version beyond 10.1.6 that has addressed this vulnerability.
What type of vulnerability is CVE-2018-3885?
CVE-2018-3885 is an SQL injection vulnerability that affects the authenticated part of ERPNext.
Which version of ERPNext is affected by CVE-2018-3885?
CVE-2018-3885 specifically affects ERPNext version 10.1.6.
What can an attacker do with CVE-2018-3885?
An attacker can exploit CVE-2018-3885 to perform SQL injection attacks, potentially leading to unauthorized data access.