CVE-2025-52041: SQL Injection
In Frappe ERPNext 15.57.5, the function getstockbalancefor() at erpnext/stock/doctype/stockreconciliation/stockreconciliation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the inventorydimensionsdict parameter.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52041?
CVE-2025-52041 is considered a critical vulnerability due to its potential for SQL Injection, which can lead to unauthorized database access.
How do I fix CVE-2025-52041?
To fix CVE-2025-52041, it is recommended to update Frappe ERPNext to the latest version where the SQL Injection vulnerability has been patched.
What type of attack does CVE-2025-52041 facilitate?
CVE-2025-52041 facilitates SQL Injection attacks that allow attackers to extract sensitive information from the database.
Which versions of Frappe ERPNext are affected by CVE-2025-52041?
Frappe ERPNext version 15.57.5 is specifically affected by CVE-2025-52041.
Where can I find more information about CVE-2025-52041?
More information about CVE-2025-52041 can typically be found in vulnerability disclosure documents and security advisories related to Frappe ERPNext.