ERPNext vulnerabilities

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to version 16.9.0, some endpoints were vulnerable to SQL injection, allowing a malicious actor to extract sensitive information.

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to versions 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection, allowing a malicious actor to extract sensitive information.

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise through the order_by parameter.

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise.

An SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can lead to data compromise through SQL injection attacks.

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise.

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0.

ERPNext prior to versions 15.118.0 and 16.29.0 contains a vulnerability in unsafe template rendering in the statement of accounts process. An authenticated user with a common operational role can inject template expressions, execute arbitrary server-side code, and read data across the application.

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to version 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role.

ERPNext v15.103.1 and earlier is vulnerable to Server-Side Template Injection (SSTI). Users with permission to create or edit email templates can inject template expressions executed on the server during rendering.

A Server-Side Request Forgery (SSRF) vulnerability was found in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1. Insufficient sanitization of user-supplied HTML allows embedding elements like <iframe> that are fetched server-side. An attacker can force the server to make arbitrary HTTP requests to internal services, including cloud metadata endpoints, potentially leading to sensitive information disclosure.

In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link, resulting in stored XSS. This may lead to account takeover, privilege escalation, or full compromise of the ERPNext instance.

ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal users, can call get_batch_qty, get_batches_by_oldest or get_pos_reserved_batch_qty to list every item batch with per-warehouse quantities.

ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hide_timesheets and project membership, so attackers can retrieve timesheet names, status, time-log dates and last modifiers.

ERPNext prior to versions 15.116.0 and 16.23.0 contains a vulnerability where an unvalidated doctype filter is interpolated into raw SQL in get_sales_details and get_last_sales_amt, allowing an authenticated user to extract sensitive information and manipulate database queries.

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py, and erpnext/accounts/utils.py omit required write permission checks, allowing authenticated limited users to modify protected data beyond their roles. This issue is fixed in versions 15.112.0 and 16.22.0.

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party field, allowing any authenticated user to read unauthorized cross-company financial data in Accounts Receivable and Accounts Payable reports. This issue is fixed in versions 15.112.0 and 16.23.0.

ERPNext prior to versions 15.109.0 and 16.20.0 has an SQL injection vulnerability in the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py, which constructs an SQL WHERE clause from request-influenced posting_date and args values. An authenticated low-privilege user can inject SQL and extract sensitive information.

ERPNext prior to versions 15.111.0 and 16.22.0 has a vulnerability in the add_ac function in erpnext/accounts/utils.py that accepts the ignore_permissions argument without enforcing Account create permission. An authenticated limited user can create unauthorized accounting master records, affecting financial data integrity and audit trails.

ERPNext prior to versions 15.111.0 and 16.22.0 has a vulnerability in the send_auto_email function in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py that lacks a Process Statement Of Accounts permission check. An authenticated low-privilege user can trigger automated emails outside the permitted role.

In ERPNext versions before 16.25.0 and before 15.115.0, there is an Improper Authorization vulnerability in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities. Insufficient access control allows unauthorized users to access data.

SQL injection vulnerability in ERPNext and Frappe due to direct string interpolation in SQL queries. An authenticated low-privilege user can execute arbitrary SQL, bypass access controls, and extract sensitive data including admin password hash.

ERPNext prior to versions 15.111.0 and 16.22.0 is vulnerable to server-side template injection (SSTI) through a configuration field. An authenticated user with a standard operational role can exploit this flaw to disclose data outside their normal permission scope.

An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields of a Customer record and trigger unescaped rendering in the Point of Sale (POS) interface for every operator who selects that customer. This affects ERPNext version 16.16.0.

ERPNext 16.16.0 allows authenticated users with Item edit permissions to inject arbitrary HTML/JavaScript into item_name, description, or image fields. This code is rendered unescaped in the POS cart interface for every operator adding that item.

ERPNext version 15.103.1 and earlier is vulnerable to Cross-Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that executes in the victim's browser when the template is applied.