Frappe SQL Injection Vulnerability Allowing Sensitive Information Disclosure

A SQL injection vulnerability has been identified in the Frappe web application framework, prior to versions 14.100.1 and 15.100.0. The issue arises from improper sanitization of field names, allowing malicious actors to craft requests that extract sensitive information from the database.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to manipulate database queries and potentially access or extract sensitive information.

Remediation

Users are advised to upgrade to Frappe versions 14.100.1 or 15.100.0.