{"id":"CVE-2018-20061","details":"A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Python function with carefully chosen arguments, a SQL attack can be carried out which allows SQL queries to be constructed to return any columns from any tables in the database. This is related to /api/resource/Item?fields= URIs, frappe.get_list, and frappe.call.","modified":"2026-08-07T11:31:02.209567346Z","published":"2018-12-11T17:29:00.507Z","database_specific":{"unresolved_ranges":[{"vendor_product":"frappe:erpnext","cpes":["cpe:2.3:a:frappe:erpnext:11.0.3:beta10:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta11:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta12:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta13:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta14:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta15:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta16:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta17:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta18:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta19:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta20:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta21:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta22:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta23:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta24:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta25:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta26:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta27:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta28:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta29:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta2:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta3:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta4:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta5:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta6:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta7:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta8:*:*:*:*:*:*","cpe:2.3:a:frappe:erpnext:11.0.3:beta9:*:*:*:*:*:*"],"extracted_events":[{"introduced":"11.0.3-beta10"},{"last_affected":"11.0.3-beta10"},{"introduced":"11.0.3-beta11"},{"last_affected":"11.0.3-beta11"},{"introduced":"11.0.3-beta12"},{"last_affected":"11.0.3-beta12"},{"introduced":"11.0.3-beta13"},{"last_affected":"11.0.3-beta13"},{"introduced":"11.0.3-beta14"},{"last_affected":"11.0.3-beta14"},{"introduced":"11.0.3-beta15"},{"last_affected":"11.0.3-beta15"},{"introduced":"11.0.3-beta16"},{"last_affected":"11.0.3-beta16"},{"introduced":"11.0.3-beta17"},{"last_affected":"11.0.3-beta17"},{"introduced":"11.0.3-beta18"},{"last_affected":"11.0.3-beta18"},{"introduced":"11.0.3-beta19"},{"last_affected":"11.0.3-beta19"},{"introduced":"11.0.3-beta2"},{"last_affected":"11.0.3-beta2"},{"introduced":"11.0.3-beta20"},{"last_affected":"11.0.3-beta20"},{"introduced":"11.0.3-beta21"},{"last_affected":"11.0.3-beta21"},{"introduced":"11.0.3-beta22"},{"last_affected":"11.0.3-beta22"},{"introduced":"11.0.3-beta23"},{"last_affected":"11.0.3-beta23"},{"introduced":"11.0.3-beta24"},{"last_affected":"11.0.3-beta24"},{"introduced":"11.0.3-beta25"},{"last_affected":"11.0.3-beta25"},{"introduced":"11.0.3-beta26"},{"last_affected":"11.0.3-beta26"},{"introduced":"11.0.3-beta27"},{"last_affected":"11.0.3-beta27"},{"introduced":"11.0.3-beta28"},{"last_affected":"11.0.3-beta28"},{"introduced":"11.0.3-beta29"},{"last_affected":"11.0.3-beta29"},{"introduced":"11.0.3-beta3"},{"last_affected":"11.0.3-beta3"},{"introduced":"11.0.3-beta4"},{"last_affected":"11.0.3-beta4"},{"introduced":"11.0.3-beta5"},{"last_affected":"11.0.3-beta5"},{"introduced":"11.0.3-beta6"},{"last_affected":"11.0.3-beta6"},{"introduced":"11.0.3-beta7"},{"last_affected":"11.0.3-beta7"},{"introduced":"11.0.3-beta8"},{"last_affected":"11.0.3-beta8"},{"introduced":"11.0.3-beta9"},{"last_affected":"11.0.3-beta9"}],"source":"CPE_STRING"}]},"references":[{"type":"ADVISORY","url":"https://github.com/frappe/erpnext/issues/15337"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/frappe/erpnext","events":[{"introduced":"7e1dc0d724bd03fc7fd46b1d479ef0f31cccf7e5"},{"last_affected":"23ee3c6fbe3c27d0dcab67d1d55e3d4d6e2d6407"},{"introduced":"0"},{"fixed":"47b82789aeff6cf9f0d3b7a9364167dc5ff5e235"}],"database_specific":{"extracted_events":[{"introduced":"10.0.0"},{"last_affected":"10.1.76"},{"introduced":"11.0.0"},{"fixed":"11.0.3"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*"}}],"versions":["v10.1.76","v10.1.65","v10.1.75","v10.1.74","v10.1.73","v10.1.72","v10.1.71","v10.1.70","v10.1.69","v10.1.68","v10.1.67","v10.1.66","v10.1.64","v10.1.63","v10.1.62","v10.1.61","v10.1.60","v10.1.59","v10.1.58","v10.1.57","v10.1.56","v10.1.55","v10.1.54","v11.0.2","v10.1.53","v11.0.1","v11.0.0-beta","v10.1.52","v10.1.51","v10.1.50","v10.1.49","v10.1.48","v10.1.47","v10.1.46","v10.1.45","v10.1.44","v10.1.43","v10.1.42","v10.1.41","v10.1.40","v10.1.39","v10.1.38","v10.1.37","v10.1.36","v10.1.35","v10.1.34","v10.1.31","v10.1.33","v10.1.32","v10.1.30","v10.1.29","v10.1.28","v10.1.27","v10.1.25","v10.1.26","v10.1.24","v10.1.23","v10.1.22","v10.1.21","v10.1.20","v10.1.19","v10.1.18","v10.1.17","v10.1.16","v10.1.15","v10.1.14","v10.1.13","v10.1.12","v10.1.11","v10.1.10","v10.1.9","v10.1.8","v10.1.7","v10.1.6","v10.1.5","v10.1.4","v10.1.3","v10.1.2","v10.1.1","v10.1.0","v10.0.23","v10.0.22","v10.0.21","v10.0.20","v10.0.19","v10.0.18","v10.0.17","v10.0.16","v10.0.15","v10.0.14","v10.0.13","v10.0.12","v10.0.9","v10.0.11","v10.0.10","v10.0.8","v10.0.7","v10.0.6","v10.0.5","v10.0.4","v10.0.3","v10.0.2","v10.0.1","v10.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20061.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}