Frappe HR SQL Injection Vulnerability in Prior Versions

A SQL injection vulnerability has been identified in Frappe HR, an open-source human resources management solution. This issue affects versions prior to 15.54.0 and 14.38.1. The vulnerability arises from improper field sanitization, allowing attackers to send specially crafted requests to certain endpoints and extract unauthorized information.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to manipulate database queries and potentially access or extract sensitive information from the database.

Remediation

Users are advised to upgrade to Frappe HR versions 15.54.0 or 14.38.1, where this vulnerability has been patched.