An unauthenticated SQL injection vulnerability in Frappe ERPNext 15.57.5 poses a critical risk of unauthorized data exfiltration.

The application fails to properly sanitize input within the txt parameter of the get_material_requests_based_on_supplier function located in erpnext/stock/doctype/material_request/material_request.py. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL queries against the underlying database.

The ability for an unauthenticated attacker to perform SQL injection directly threatens the confidentiality and integrity of the organization's ERP data. Given the CVSS score of 8.2, this vulnerability could lead to the complete compromise of sensitive business records, financial information, or customer data, resulting in severe regulatory and reputational consequences.

Immediate Action: Review the provided vendor pull request and apply the corresponding security patch to the erpnext/stock/doctype/material_request/material_request.py file.

Proactive Monitoring: Monitor database query logs for suspicious patterns, specifically looking for unusual syntax or high volumes of unexpected queries originating from the material request endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious input directed at the vulnerable material request parameter.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the vulnerability disclosure referenced in the enrichment data.

This vulnerability represents a significant security risk due to its potential for unauthenticated data exfiltration. System administrators should prioritize the application of the vendor-provided fix immediately. If a formal patch is not yet available through your distribution channel, apply the logic changes from the official commit to mitigate the risk until an official update is released.