CVE-2018-20061
Description
A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Python function with carefully chosen arguments, a SQL attack can be carried out which allows SQL queries to be constructed to return any columns from any tables in the database. This is related to /api/resource/Item?fields= URIs, frappe.get_list, and frappe.call.
How to fix
- frappe erpnext11.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| frappe erpnext | 10.0.0 ≤ v ≤ 10.1.76, 11.0.0 ≤ v < 11.0.3, 11.0.3 | 11.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.