CVE-2023-42807 Frappe LMS SQL Injection Issue on People Page
An SQL injection vulnerability in the People Page of Frappe LMS allows attackers to read or modify database contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-42807?
CVE-2023-42807 is a medium-severity SQL injection vulnerability in frappe lms, published on 21 Sep 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerability. The issue has been fixed in the `main` branch. Users won't face this issue if they are using the latest main branch of the app.
Weakness: CWE-89
Which versions are affected by CVE-2023-42807?
It affects 1 product.
Products include Frappe Learning.
How do I fix CVE-2023-42807?
No fix has been published for CVE-2023-42807 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-42807 being exploited?
There is no known exploitation of CVE-2023-42807 in the wild and no public exploit code.
Other vulnerabilities in frappe lms
- CVE-2023-5555 Cross-site Scripting (XSS) - Generic in frappe/lms
- CVE-2026-34606 Stored XSS in Frappe LMS
- CVE-2026-26977 Frappe Learning Management System exposes details of unpublished courses to unauthorized users
- CVE-2025-11280 Frappe LMS Assignment Picture files direct request
- CVE-2026-39415 Frappe Learning Management System has Client-Side Manipulation of Quiz Scores
Sources
Also known as GHSA-m47x-32hh-m2m6, GHSA-wvq3-3wvp-6x63.