CVE-2025-52047
📋 TL;DR
This SQL injection vulnerability in Frappe ERPNext allows attackers to execute arbitrary SQL queries through the filters.disabled parameter in the get_income_account() function. Attackers can extract sensitive data from databases including user credentials, financial records, and business data. All organizations running vulnerable versions of ERPNext are affected.
💻 Affected Systems
- Frappe ERPNext
📦 What is this software?
Erpnext by Frappe
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration of all sensitive information, including user credentials, financial transactions, customer data, and business intellectual property.
Likely Case
Extraction of sensitive business data, user information, and potential privilege escalation through credential harvesting.
If Mitigated
Limited data exposure if proper input validation and database permissions are implemented, though SQL injection attempts would still be logged.
🎯 Exploit Status
Exploitation requires understanding of the application's API endpoints and SQL injection techniques. The vulnerability is in a specific function with documented parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 6320f7290f93a5278ffdfaa790af70427c20a1c8
Vendor Advisory: https://github.com/frappe/erpnext/pull/49192/commits/6320f7290f93a5278ffdfaa790af70427c20a1c8
Restart Required: No
Instructions:
1. Update to the latest ERPNext version. 2. Apply the specific commit 6320f7290f93a5278ffdfaa790af70427c20a1c8 if not updating fully. 3. Verify the fix by checking the queries.py file for proper parameter sanitization.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to sanitize the filters.disabled parameter before processing.
Database Permission Restriction
allLimit database user permissions to read-only for the application account where possible.
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with SQL injection rules
- Restrict access to the vulnerable endpoint using network ACLs or authentication
🔍 How to Verify
Check if Vulnerable:
Check if your ERPNext version is v15.57.5 or earlier and review the erpnext/controllers/queries.py file for the vulnerable get_income_account() function.Check Version:
bench versionVerify Fix Applied:
Verify that the queries.py file includes proper parameter sanitization and SQL injection prevention in the get_income_account() function.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to the vulnerable endpoint with SQL-like parameters
- Error messages containing SQL syntax in application logs
Network Indicators:
- Unusual patterns of requests to API endpoints with SQL injection payloads
- High volume of requests to the queries.py related endpoints
SIEM Query:
source=application_logs AND ("filters.disabled" OR "get_income_account") AND (sql OR union OR select OR "--" OR ";")