CVE-2025-52042

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-52042
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query via the txt parameter.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md Exploit Third Party Advisory
https://github.com/frappe/erpnext/pull/49192/commits/7f2a52ff71a1fd5d4a9034cf217094c0be9f341a Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:frappe:erpnext:15.57.5:*:*:*:*:*:*:*
History

03 Oct 2025, 16:19

Type Values Removed Values Added
CPE cpe:2.3:a:frappe:erpnext:15.57.5:*:*:*:*:*:*:*
First Time Frappe erpnext
Frappe
References () https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - () https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - Exploit, Third Party Advisory
References () https://github.com/frappe/erpnext/pull/49192/commits/7f2a52ff71a1fd5d4a9034cf217094c0be9f341a - () https://github.com/frappe/erpnext/pull/49192/commits/7f2a52ff71a1fd5d4a9034cf217094c0be9f341a - Patch

01 Oct 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-10-01 15:15

Updated : 2025-10-03 16:19

NVD link : CVE-2025-52042

Mitre link : CVE-2025-52042

CVE.ORG link : CVE-2025-52042

JSON object : View

Products Affected

frappe

  • erpnext
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')