ERPNext SQL Injection Vulnerability Allowing Sensitive Information Disclosure

A SQL injection vulnerability has been identified in ERPNext, an open-source Enterprise Resource Planning tool. This issue affects versions prior to 15.104.3 and 16.14.0. The vulnerability arises from some endpoints lacking proper validation, allowing malicious actors to craft requests that extract sensitive information.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to manipulate database queries and potentially access or extract sensitive information from the database.

Remediation

Users are advised to upgrade to ERPNext versions 15.104.3 or 16.14.0, where this vulnerability has been patched.