CVE-2025-52039: SQL Injection
In Frappe ERPNext 15.57.5, the function getmaterialrequestsbasedonsupplier() at erpnext/stock/doctype/materialrequest/materialrequest.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the txt parameter.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52039?
CVE-2025-52039 is classified as a high severity vulnerability due to its potential for SQL injection.
How do I fix CVE-2025-52039?
To fix CVE-2025-52039, you should upgrade to the latest version of Frappe ERPNext where the vulnerability has been patched.
What systems are affected by CVE-2025-52039?
CVE-2025-52039 affects Frappe ERPNext version 15.57.5.
What type of attack does CVE-2025-52039 enable?
CVE-2025-52039 enables SQL injection attacks, allowing attackers to retrieve sensitive database information.
In which function does CVE-2025-52039 exist?
CVE-2025-52039 exists in the function get_material_requests_based_on_supplier() located in the material_request.py file.