CVE-2025-66440: SQL Injection
An issue was discovered in Frappe ERPNext through 15.89.0. Function getoutstandingreferencedocuments() at erpnext/accounts/doctype/paymententry/paymententry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the topostingdate parameter, which is directly interpolated into the query without proper sanitization or parameter binding.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66440?
CVE-2025-66440 has been classified as a critical severity vulnerability due to its potential for SQL Injection, which can lead to unauthorized data access.
How do I fix CVE-2025-66440?
To fix CVE-2025-66440, upgrade Frappe to a version later than 15.89.0 where the vulnerability has been addressed.
Which versions of Frappe are affected by CVE-2025-66440?
CVE-2025-66440 affects Frappe versions up to and including 15.89.0.
What type of vulnerability is CVE-2025-66440?
CVE-2025-66440 is an SQL Injection vulnerability that allows attackers to manipulate SQL queries and access database information.
What can an attacker do with CVE-2025-66440?
An attacker exploiting CVE-2025-66440 can extract arbitrary data from the database by injecting crafted SQL payloads.