Frappe ERPNext CVE-2025-66440

Requires an authenticated ERPNext session with access to the payment-entry functionality that calls get_outstanding_reference_documents() (consistent with PR:L); the attacker injects SQL through the to_posting_date parameter, which is interpolated into the query without parameter binding. No special or non-default configuration, plugin, or user interaction is needed, and the flaw affects default installations of Frappe ERPNext through version 15.89.0. The primary limiting factor is the authentication requirement - a valid low-privilege account is necessary, so fully unauthenticated exploitation is not indicated; exposure is therefore highest in multi-tenant, self-service, or internet-facing deployments where low-privilege accounts are easy to obtain.

This is a genuine, actionable priority rather than an inflated high-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity SQL injection (CWE-89) requiring only a low-privilege authenticated session and no user interaction - a profile that is reliably exploitable once an attacker has any valid ERPNext account. The input reports POC=YES with a public write-up (iamanc.github.io), which materially raises real-world risk because a working technique is documented; however, the CVE is NOT listed in CISA KEV and no EPSS probability or SSVC decision data was supplied in the input, so there is no evidence of active, widespread exploitation at this time - only that exploit code is public. The one signal tension worth flagging: the description frames the impact as data extraction ('extract arbitrary data from the database'), which cleanly supports C:H, whereas the I:H/A:H ratings assume the injection point also permits writes or destructive/stacked queries - plausible for SQLi but not explicitly demonstrated in the provided description, so integrity/availability impact should be verified against the actual query context. Net: treat as a high-priority patch for any internet-exposed or multi-tenant ERPNext deployment, driven by low attack complexity plus public POC, while recognizing active exploitation is not confirmed.

An attacker with any low-privilege authenticated ERPNext account (or a user who compromises such credentials) invokes the payment-entry workflow and supplies a crafted SQL payload in the to_posting_date parameter, which is interpolated directly into the backend query. Because a public proof-of-concept write-up exists, the attacker can follow a known technique to dump sensitive accounting, customer, and credential data from the database. The low attack complexity (AC:L) and network vector (AV:N) make this reliable against any reachable instance once authenticated.