CVE-2025-66439: SQL Injection
An issue was discovered in Frappe ERPNext through 15.89.0. Function getoutstandingreferencedocuments() at erpnext.accounts.doctype.paymententry.paymententry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the frompostingdate parameter, which is directly interpolated into the query without proper sanitization or parameter binding.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66439?
CVE-2025-66439 is classified as a critical severity vulnerability due to its potential for SQL Injection, allowing attackers to extract arbitrary data.
How do I fix CVE-2025-66439?
To fix CVE-2025-66439, update Frappe ERPNext to a version higher than 15.89.0 where the vulnerability has been addressed.
What types of systems are affected by CVE-2025-66439?
CVE-2025-66439 affects Frappe ERPNext versions up to and including 15.89.0.
What is the impact of exploiting CVE-2025-66439?
Exploiting CVE-2025-66439 allows an attacker to execute SQL commands and potentially extract sensitive data from the database.
Who is responsible for fixing CVE-2025-66439 in affected systems?
System administrators using affected versions of Frappe ERPNext are responsible for implementing the necessary updates to mitigate CVE-2025-66439.