CVE-2025-13168 is a medium severity SQL injection (CVSS 6.3) in ury-erp ury, in versions up to 0.2.0. The vulnerable function takes a search_term argument. The record says upgrading to version 0.2.1 mitigates the issue, so move to 0.2.1 or later.
What's affected
The affected product is ury-erp ury, versions up to and including 0.2.0. The record places the flaw in the function overrided_past_order_list in ury/ury/api/pos_extend.py, where the search_term argument ends up inside a SQL query.
The record states that upgrading to version 0.2.1 mitigates the issue and names a patch commit, 063384e0dddfd191847cd2d6524c342cc380b058, in the ury-erp repository. It also says the vendor replied professionally, which is a useful sign when you decide how much to trust the project's fix cadence.
The weakness is CWE-89 under the broader CWE-74. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which means the attacker needs a low privilege account first. The kev flag is false.
How to check if you're exposed
Check which version of ury you have deployed. ury runs as an app on a Frappe bench, so you can list installed apps and their versions:
bench version
Look for the ury line. If it shows 0.2.0 or lower, you are affected. If you installed from Git, check the commit instead:
cd apps/ury && git log -1 --format=%H
git merge-base --is-ancestor 063384e0dddfd191847cd2d6524c342cc380b058 HEAD && echo patched || echo not patched
The second command tells you whether the patch commit is in your history. If you vendor the code or run a fork, apply the same test to your branch.
If you track dependencies in a repository, a dependency scan will flag the version too. The free in-browser dependency scan is a quick way to try.
What to do now
- Find every ury instance you run, including staging.
- Back up the site and database before changing anything.
- Upgrade ury to 0.2.1 or later, then run your usual migrate and restart steps.
- Re-run
bench versionand confirm the new number. - If you cannot upgrade yet, limit which users can reach the point of sale search and review who holds those accounts, since the attack needs a low privilege login.
- Review database access logs for unusual search queries since the CVE was published on 14 November 2025.
- Keep the patch commit in your notes so a future audit can confirm the fix without guessing.
Why it matters
The function builds a query using the search_term value. When that value is placed into the statement as text instead of being bound as a parameter, the database cannot tell data from instructions. That is CWE-89, a form of injection.
A point of sale and ERP system holds order history, customer details and staff accounts, so even a medium score deserves quick attention. The requirement for a low privilege login limits the audience, but in a restaurant or retail setting many staff accounts exist, and shared passwords are common.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the fixed version?
The record says upgrading to version 0.2.1 mitigates the issue. It also lists the patch commit 063384e0dddfd191847cd2d6524c342cc380b058.
Does this need a login?
Yes, a low privilege account. The vector shows PR:L.
Sources
- Safeguard Gold entry for CVE-2025-13168
- https://github.com/ictrun/ury-vulns/blob/main/README.md
- https://github.com/ictrun/ury-vulns/blob/main/README.md#verification-steps
- https://github.com/ury-erp/ury/commit/063384e0dddfd191847cd2d6524c342cc380b058
- https://github.com/ury-erp/ury/releases/tag/v0.2.1
Last reviewed: 19 October 2026.
