Frappe ERPNext SQL Injection Vulnerability in Chart of Accounts Importer

A SQL injection vulnerability has been identified in Frappe ERPNext version 15.57.5, specifically within the 'import_coa()' function of the Chart of Accounts Importer module. This vulnerability allows attackers to inject SQL queries through the 'company' parameter, potentially leading to the extraction of sensitive information from the database.

Impact

Exploitation of this vulnerability allows for error-based SQL injection, enabling attackers to manipulate SQL queries and access or modify database information.

Reproduction

The vulnerability can be reproduced by sending a request to the 'import_coa()' function with a crafted 'company' parameter that includes an injected SQL query. This can be done through the ERPNext API or by directly calling the function in a Python environment where Frappe ERPNext is running.

Remediation

Users are advised to update to the latest version of Frappe ERPNext, where this vulnerability has been patched.