CVE-2025-30212
Published: 25 March 2025
Summary
CVE-2025-30212 is a high-severity SQL Injection (CWE-89) vulnerability in Frappe Frappe. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validating and sanitizing user inputs to prevent SQL injection vulnerabilities like CVE-2025-30212 from allowing unauthorized database access.
SI-2 mandates timely identification, reporting, and correction of software flaws, directly requiring upgrades to patched Frappe versions 14.89.0 or 15.51.0.
RA-5 requires vulnerability scanning to identify SQL injection flaws like CVE-2025-30212 prior to exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing Frappe web app framework enables remote unauthenticated extraction of database data, directly mapping to exploitation of public-facing applications.
NVD Description
Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0 which could allow a malicious actor to access sensitive information. Versions 14.89.0 and 15.51.0 fix the issue.…
more
Upgrading is required; no other workaround is present.
Deeper analysisAI
CVE-2025-30212 is an SQL injection vulnerability (CWE-89) in the Frappe Framework, a full-stack web application framework. It affects versions prior to 14.89.0 and 15.51.0, potentially allowing malicious actors to access sensitive information. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with network accessibility, low attack complexity, and no requirements for privileges or user interaction.
Unauthenticated attackers can exploit this vulnerability remotely over the network without user interaction. Successful exploitation enables extraction of sensitive data from the underlying database, though it does not impact integrity or availability.
The Frappe security advisory (GHSA-3hj6-r5c9-q8f3) and associated GitHub commits (27f13437db161a173137d91cd07d0f9287d7c556 and 2ebd88520ecfa9bb7d3392b7de8c8f94a86ec05c) confirm that versions 14.89.0 and 15.51.0 address the issue. Mitigation requires upgrading to one of these patched versions, as no workarounds are available.
Details
- CWE(s)