PT-2018-16276 · Frappé Technologies · Erpnext

Published 2018-09-12 · Updated 2026-05-08 · CVE-2018-3883

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ERPNext version 10.1.6

Description An exploitable SQL injection issue exists in the authenticated part of the software. Specially crafted web requests can cause SQL injections, resulting in data compromise. The employee and sort order parameters can be used to perform an SQL injection attack. An attacker can use a browser to trigger this issue, and no special tools are required.

Recommendations For ERPNext version 10.1.6, consider restricting access to the authenticated part of the software and avoid using the employee and sort order parameters in web requests until a fix is available. As a temporary workaround, restrict the use of these parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-3883

Affected Products

Erpnext

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0560 · Exploit
• https://osv.dev/vulnerability/CVE-2018-3883 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3883 · Security Note
• https://t.me/cveNotify/162726 · Telegram Post