Frappe ERPNext CVE-2025-66439

Requires an authenticated ERPNext session with access to the Payment Entry / Accounts-module outstanding-reference lookup that invokes get_outstanding_reference_documents(); the attacker supplies a malicious from_posting_date value that is interpolated into the SQL query without parameter binding. Limiting factors: valid credentials are required (PR:L - not anonymous), and the user must be able to reach the payment-entry reference functionality; no special non-default configuration is indicated, so default deployments of ERPNext up to and including 15.89.0 are affected. No user interaction by a victim is needed (UI:N).

This is a genuine, actionable priority rather than an inflated CVSS score. The provided CVSS:3.1/AV:N/AC:L/PR:L/UI:N vector indicates network-reachable, low-complexity exploitation requiring only low-privilege authentication (PR:L) - consistent with the description, since get_outstanding_reference_documents() is a Payment Entry/Accounts-module endpoint that an authenticated application user reaches. A public exploit write-up exists (iamanc.github.io), so publicly available exploit code exists, raising practical risk above a theoretical SQLi. However, several signals are missing or must be caveated: no EPSS score was supplied, so widespread-exploitation probability cannot be quantified; the CVE is NOT in CISA KEV, so there is no confirmed active exploitation. The authentication barrier (PR:L) meaningfully narrows the threat to users who already hold valid ERPNext accounts (e.g., employees, portal/accounts users), making insider or post-credential-compromise abuse the realistic vector rather than anonymous internet-wide scanning. Net: treat as a high-priority patch for any internet-exposed or multi-tenant ERPNext instance, but note the authentication requirement tempers mass-exploitation likelihood versus a PR:N flaw.

A low-privileged but authenticated ERPNext user (such as an employee or accounts-role user) navigates to the Payment Entry reference-lookup feature and submits a crafted from_posting_date value containing a SQL payload, which is interpolated directly into the backend query. Because a public proof-of-concept write-up exists, an attacker can follow documented steps to extract arbitrary database contents such as credentials, financial records, and other tenants' data. Exploitation is remote over the network with low attack complexity (AV:N/AC:L) but is gated by the need for a valid low-privilege session (PR:L).