Frappe ERPNext Error-Based SQL Injection Vulnerability

A vulnerability allowing error-based SQL injection has been identified in Frappe ERPNext. This issue affects versions prior to 14.89.2 and 15.0.0 through 15.75.1. The vulnerability arises from a lack of parameter validation in certain endpoints, which could be exploited to retrieve information such as the application version.

Impact

Exploitation of this vulnerability allows for error-based SQL injection, where an attacker can manipulate SQL queries to extract information from the database or potentially execute arbitrary SQL commands.

Remediation

Users can upgrade to ERPNext versions 14.89.2 or 15.76.0 to address this vulnerability.