CVE-2025-52895: Frappe Framework SQLi Vulnerability

CVE-2025-52895 Overview

CVE-2025-52895 is a SQL injection vulnerability in Frappe, a full-stack web application framework used by ERPNext and other enterprise applications. The flaw exists in the database query handling logic prior to versions 14.94.3 and 15.58.0. Attackers with low privileges can submit specially crafted requests that bypass the blacklist of restricted SQL functions in order by and group by clauses. Successful exploitation allows retrieval of sensitive database contents. The issue is tracked under CWE-89 and has been patched in the maintained release lines.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the Frappe backend, exposing confidential data across application tenants.

Affected Products

Frappe Framework versions prior to 14.94.3
Frappe Framework versions prior to 15.58.0
Downstream applications built on vulnerable Frappe releases (e.g., ERPNext)

Discovery Timeline

2025-06-30 - CVE-2025-52895 published to NVD
2025-07-08 - Last updated in NVD database

Technical Details for CVE-2025-52895

Vulnerability Analysis

The vulnerability resides in frappe/model/db_query.py, which constructs SQL statements for report queries and list views. Frappe maintains a blacklisted_sql_functions list to prevent users from invoking dangerous SQL functions such as those that could disclose schema or system data. The pre-patch logic performed an exact-match check using if function in blacklisted_sql_functions. Attackers bypassed this filter by wrapping or combining blacklisted functions with additional SQL syntax. The crafted order by or group by field then passed validation and was interpolated into the executed query.

Root Cause

The root cause is insufficient input validation [CWE-89]. The original check compared the entire user-supplied function string against a fixed list of forbidden tokens. Any payload that embedded a blacklisted function inside a larger expression evaded the comparison. The fix replaces the equality check with a substring scan that flags the field if any blacklisted function name appears anywhere within it.

Attack Vector

Exploitation requires network access to the Frappe application and a valid low-privileged user account. The attacker submits a report or list query that includes a malicious order_by or group_by parameter. The payload embeds blacklisted SQL functions within a larger expression to bypass the exact-match filter. The injected SQL executes with the privileges of the Frappe database user, allowing the attacker to read sensitive tables.

python

						tbl = tbl[4:-1]
					frappe.throw(_("Please select atleast 1 column from {0} to sort/group").format(tbl))

-			if function in blacklisted_sql_functions:
-				frappe.throw(_("Cannot use {0} in order/group by").format(field))
+			# Check if the function is used anywhere in the field
+			if any(func in function for func in blacklisted_sql_functions):
+				frappe.throw(_("Cannot use {0} in order/group by").format(function))

	def add_limit(self):
		if self.limit_page_length:

Source: GitHub Commit c795e35

Detection Methods for CVE-2025-52895

Indicators of Compromise

HTTP requests to Frappe endpoints containing order_by or group_by parameters with embedded SQL function names such as SLEEP, BENCHMARK, LOAD_FILE, or UPDATEXML.
Application logs showing the warning Cannot use {function} in order/group by after the patch is applied, indicating bypass attempts.
Unusual database query latency or large result sets returned to authenticated low-privilege accounts.

Detection Strategies

Inspect web access logs for query strings containing parentheses, comments, or stacked function calls in sort and group fields.
Enable MariaDB or MySQL general query logging and search for queries originating from Frappe with non-standard ORDER BY clauses.
Correlate Frappe user session activity with database errors or schema-introspection queries on tables such as tabUser or __Auth.

Monitoring Recommendations

Forward Frappe application logs and database query logs to a centralized analytics platform for behavioral baselining.
Alert on authenticated users issuing report queries that reference SQL functions not used in normal business workflows.
Track version metadata of Frappe installations across the estate to identify hosts still running pre-14.94.3 or pre-15.58.0 builds.

How to Mitigate CVE-2025-52895

Immediate Actions Required

Upgrade Frappe to version 14.94.3, 15.58.0, or later as published in the GitHub Security Advisory GHSA-mhj8-jfhf-mcw9.
Audit user accounts with report-building or list-view permissions and rotate database credentials if abuse is suspected.
Review database audit logs for unauthorized access to sensitive tables prior to patch deployment.

Patch Information

The maintainers shipped fixes in commits c795e35 for the 14.x branch and f093359 for the 15.x branch. Both patches change the blacklist comparison in frappe/model/db_query.py from an exact equality check to a substring scan, blocking embedded function payloads. Full details are documented in GitHub Pull Request #31526.

Workarounds

No workarounds are available. The vendor advisory explicitly states that upgrading is the only remediation path.
Where immediate upgrade is not feasible, restrict access to report and list endpoints to trusted users via reverse proxy rules.
Apply database-level least privilege so the Frappe application account cannot read tables outside its functional scope.

bash

# Upgrade Frappe via bench to a patched release
bench update --reset
bench version
# Verify frappe >= 15.58.0 (or >= 14.94.3 on the v14 branch)