CVE-2025-66205
📋 TL;DR
This CVE describes an error-based SQL injection vulnerability in the Frappe web application framework. Attackers can exploit this to retrieve sensitive information like database version details. Organizations using vulnerable Frappe versions (before 15.86.0 or 14.99.2) are affected.
💻 Affected Systems
- Frappe Framework
📦 What is this software?
Frappe by Frappe
Frappe by Frappe
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise leading to data exfiltration, privilege escalation, or complete system takeover if combined with other vulnerabilities.
Likely Case
Information disclosure of database metadata, potentially enabling further attacks or reconnaissance.
If Mitigated
Limited information leakage with proper input validation and WAF protection in place.
🎯 Exploit Status
Error-based SQL injection typically requires some trial and error but is well-understood by attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 15.86.0 or 14.99.2
Vendor Advisory: https://github.com/frappe/frappe/security/advisories/GHSA-mp93-8vxr-hqq9
Restart Required: Yes
Instructions:
1. Update Frappe to version 15.86.0 or 14.99.2 using bench update command. 2. Restart all Frappe services. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Input Validation WAF Rule
allImplement web application firewall rules to block SQL injection patterns targeting the vulnerable endpoint.
Endpoint Restriction
allRestrict access to the vulnerable endpoint using network ACLs or authentication requirements.
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries at application level.
- Deploy a WAF with SQL injection protection rules and monitor for exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check Frappe version using bench version command and compare against vulnerable versions.Check Version:
bench versionVerify Fix Applied:
Confirm Frappe version is 15.86.0 or higher (for v15) or 14.99.2 or higher (for v14).📡 Detection & Monitoring
Log Indicators:
- Unusual database error messages in application logs
- Repeated requests to vulnerable endpoint with SQL-like parameters
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, etc.) to Frappe endpoints
SIEM Query:
source="frappe_logs" AND (error OR sql OR injection)