Lucene search
PRIOn knowledge basePRION:CVE-2018-20061HistoryDec 11, 2018 - 5:29 p.m.
Sql injection
2018-12-1117:29:00
PRIOn knowledge base
www.prio-n.com
3
A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Python function with carefully chosen arguments, a SQL attack can be carried out which allows SQL queries to be constructed to return any columns from any tables in the database. This is related to /api/resource/Item?fields= URIs, frappe.get_list, and frappe.call.
| CPE | Name | Operator | Version |
|---|---|---|---|
| erpnext | ge | 10.0.0 | |
| erpnext | le | 10.1.76 | |
| erpnext | ge | 11.0.0 | |
| erpnext | lt | 11.0.3 | |
| erpnext | eq | 11.0.3 beta2 | |
| erpnext | eq | 11.0.3 beta3 | |
| erpnext | eq | 11.0.3 beta4 | |
| erpnext | eq | 11.0.3 beta5 | |
| erpnext | eq | 11.0.3 beta6 | |
| erpnext | eq | 11.0.3 beta7 |
References
Related
osv
osv
CVE-2018-20061
2018-12-11 17:29:00
cve
cve
CVE-2018-20061
2018-12-11 17:29:00
cvelist
cvelist
CVE-2018-20061
2018-12-11 17:00:00
nvd
nvd
CVE-2018-20061
2018-12-11 17:29:00