Frappe Framework SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Frappe Framework versions prior to 14.89.0 and 15.51.0. This vulnerability allows malicious actors to manipulate SQL queries, potentially leading to unauthorized access to sensitive information. The issue arises from improper validation of user inputs, which can be exploited to inject malicious SQL code into database queries.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

The vulnerability can be reproduced by sending crafted input that bypasses the application's SQL query validation. This can be done through forms or API endpoints that accept user input and interact with the database. The injected SQL code can then be used to manipulate database queries, such as retrieving, modifying, or deleting data.

Remediation

Users are advised to upgrade to Frappe Framework versions 14.89.0 or 15.51.0, where this vulnerability has been patched.