CVE:CVE-2018-20061
CNNVD:CNNVD-201812-490
Frappe ERPNext是一套开源的ERP（企业资源计划）系统。该系统包括财务管理、库存管理、客户关系管理、项目管理和人力资源管理等功能。
Frappe ERPNext 10.x版本和11.x版本至11.0.3-beta.29版本中存在SQL注入漏洞。远程攻击者可利用该漏洞获取数据库中任意表单的任意列。
solution:Upgrade frappe erpnext to a higher version than 10.1.76,11.0.3,11.0.3:beta10,11.0.3:beta11,11.0.3:beta12,11.0.3:beta13,11.0.3:beta14,11.0.3:beta15,11.0.3:beta16,11.0.3:beta17,11.0.3:beta18,11.0.3:beta19,11.0.3:beta2,11.0.3:beta20,11.0.3:beta21,11.0.3:beta22,11.0.3:beta23,11.0.3:beta24,11.0.3:beta25,11.0.3:beta26,11.0.3:beta27,11.0.3:beta28,11.0.3:beta29,11.0.3:beta3,11.0.3:beta4,11.0.3:beta5,11.0.3:beta6,11.0.3:beta7,11.0.3:beta8,11.0.3:beta9,and avoid the version [10.0.0,10.1.76],[11.0.0,11.0.3),11.0.3:beta10,11.0.3:beta11,11.0.3:beta12,11.0.3:beta13,11.0.3:beta14,11.0.3:beta15,11.0.3:beta16,11.0.3:beta17,11.0.3:beta18,11.0.3:beta19,11.0.3:beta2,11.0.3:beta20,11.0.3:beta21,11.0.3:beta22,11.0.3:beta23,11.0.3:beta24,11.0.3:beta25,11.0.3:beta26,11.0.3:beta27,11.0.3:beta28,11.0.3:beta29,11.0.3:beta3,11.0.3:beta4,11.0.3:beta5,11.0.3:beta6,11.0.3:beta7,11.0.3:beta8,11.0.3:beta9