Description
Frappe ERPNext 15.57.5 版本中，erpnext/controllers/queries.py 文件内的 get_income_account() 函数存在 SQL 注入漏洞。该函数在处理 filters.disabled 参数时未进行充分的过滤和参数化绑定，攻击者可构造恶意 SQL 语句注入后台数据库查询，从而在未授权的情况下获取数据库中的全部敏感信息。
ERPNext /api/method/erpnext.controllers.queries.get_income_account SQL 注入漏洞（CVE-2025-52047）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-52047
https://access.redhat.com/security/cve/cve-2025-52047
https://github.com/advisories/GHSA-hgxj-8mw3-fx8w
https://www.cvedetails.com/cve/CVE-2025-52047/
https://cvefeed.io/vuln/detail/CVE-2025-52047
https://strobes.co/vi/cve/CVE-2025-52047
https://www.thehackerwire.com/vulnerability/CVE-2025-52047/
https://cve.imfht.com/detail/CVE-2025-52047