CVE-2025-66440
📋 TL;DR
This SQL injection vulnerability in Frappe ERPNext allows attackers to execute arbitrary SQL commands through the to_posting_date parameter. It enables unauthorized database access, potentially exposing sensitive financial and business data. All organizations running vulnerable ERPNext versions are affected.
💻 Affected Systems
- Frappe ERPNext
📦 What is this software?
Erpnext by Frappe
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, financial fraud, business disruption, and potential lateral movement to other systems.
Likely Case
Unauthorized access to sensitive business data including financial records, customer information, and proprietary business data.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploitation requires authenticated access. The SQL injection is straightforward with direct parameter interpolation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 15.90.0 or later
Vendor Advisory: https://github.com/frappe/frappe/security
Restart Required: Yes
Instructions:
1. Backup your ERPNext instance and database. 2. Update to ERPNext version 15.90.0 or later. 3. Restart the ERPNext services. 4. Verify the patch is applied correctly.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize the to_posting_date parameter before processing
Modify erpnext/accounts/doctype/payment_entry/payment_entry.py to validate date format
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule: deny requests containing SQL keywords in to_posting_date parameter
🧯 If You Can't Patch
- Implement strict input validation for all date parameters in the application
- Restrict database user permissions to minimum required privileges
🔍 How to Verify
Check if Vulnerable:
Check if ERPNext version is 15.89.0 or earlier. Review payment_entry.py for vulnerable get_outstanding_reference_documents() function.Check Version:
bench versionVerify Fix Applied:
Verify ERPNext version is 15.90.0 or later. Check that payment_entry.py uses parameterized queries for to_posting_date.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by payment entry access
- Unexpected database queries from application user
Network Indicators:
- Unusual patterns in POST requests to payment entry endpoints
- SQL keywords in URL parameters
SIEM Query:
source="web_logs" AND (url="*payment_entry*" AND (param="*to_posting_date*" AND value="*SELECT*" OR value="*UNION*" OR value="*OR*"))