VYPR
← All advisories
High severity7.5OSV Advisory· Published Dec 11, 2018· Updated Jun 17, 2026

CVE-2018-20061

CVE-2018-20061

Description

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Python function with carefully chosen arguments, a SQL attack can be carried out which allows SQL queries to be constructed to return any columns from any tables in the database. This is related to /api/resource/Item?fields= URIs, frappe.get_list, and frappe.call.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

31
  • Frappe/ErpnextOSV31 versions
    v10.0.0, v10.0.1, v10.0.10, …+ 30 more
    • (no CPE)range: v10.0.0, v10.0.1, v10.0.10, …
    • cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*range: >=10.0.0,<=10.1.76
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta10:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta11:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta12:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta13:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta14:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta15:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta16:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta17:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta18:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta19:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta20:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta21:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta22:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta23:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta24:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta25:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta26:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta27:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta28:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta29:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta2:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta3:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta4:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta5:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta6:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta7:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta8:*:*:*:*:*:*
    • cpe:2.3:a:frappe:erpnext:11.0.3:beta9:*:*:*:*:*:*
    • (no CPE)range: 10.x and 11.x through 11.0.3-beta.29

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.