ERPNext /api/method/erpnext.stock.doctype.material_request.material_request.get_material_requests_based_on_supplier SQL 注入漏洞（CVE-2025-52039）

2026-03-09 ERPNext PoC No

Description

在 Frappe ERPNext 15.57.5 版本中，erpnext/stock/doctype/material_request/material_request.py 文件中的 get_material_requests_based_on_supplier() 函数存在 SQL 注入漏洞。该函数在处理 txt 参数时未进行充分的过滤与参数化绑定，攻击者可通过注入 SQL 查询来获取数据库中的全部敏感信息。

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

https://nvd.nist.gov/vuln/detail/CVE-2025-52039
https://github.com/advisories/GHSA-p27p-9h7f-gjj8
https://app.opencve.io/cve/CVE-2025-52039
https://www.ameeba.com/blog/cve-2025-52039-sql-injection-vulnerability-in-frappe-erpnext/
https://devhub.checkmarx.com/cve-details/cve-2025-52039/
https://www.kodemsecurity.com/cve-database/cve-2025-52039
https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md
https://github.com/frappe/erpnext/pull/49192/commits/de919568b4f7a86c8d418c0c3fd88e1f3101696c

Description

PoC

References

Related Vulnerabilities