Description
Frappe ERPNext 15.57.5 版本中，erpnext/controllers/queries.py 文件内的 get_blanket_orders() 函数存在 SQL 注入漏洞。该函数在处理 blanket_order_type 参数时未进行充分的过滤和参数化绑定，攻击者可通过注入恶意 SQL 查询来获取数据库中的所有敏感信息。
ERPNext /api/method/erpnext.controllers.queries.get_blanket_orders SQL 注入漏洞（CVE-2025-52040）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-52040
https://app.opencve.io/cve/CVE-2025-52040
https://vulners.com/cve/CVE-2025-52040
https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-52040
https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md
https://www.thehackerwire.com/vulnerability/CVE-2025-52040/
https://cvefeed.io/vuln/detail/CVE-2025-52040
https://vuldb.com/am/?id.326647