An unauthenticated SQL injection vulnerability in Frappe ERPNext 15.57.5 allows remote attackers to perform unauthorized database queries and extract sensitive information.

The application is vulnerable to SQL injection via the blanket_order_type parameter in the get_blanket_orders function located within erpnext/controllers/queries.py. This flaw permits an unauthenticated attacker to inject malicious SQL queries to bypass security controls and retrieve data from the backend database.

The ability to perform unauthenticated SQL injection poses a severe risk to data confidentiality and integrity. Given the CVSS score of 8.2, this vulnerability could lead to the total exposure of sensitive business data stored within the ERP system, potentially resulting in regulatory non-compliance, loss of intellectual property, and significant reputational damage.

Immediate Action: Update Frappe ERPNext to a version that incorporates the fix provided in the vendor pull request (commit 1db135262d9474411ef54e3367d24bb169d2503e).

Proactive Monitoring: Monitor database query logs for syntax errors, unexpected UNION operators, or unusual access patterns originating from the get_blanket_orders endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection patterns in HTTP requests targeting the ERPNext framework.

Public Exploit Available: Yes, a technical write-up containing attack details has been published by a security researcher.

This vulnerability represents a high-risk entry point for unauthorized actors to compromise the integrity and confidentiality of the Frappe ERPNext environment. Organizations are strongly advised to verify their current version and apply the upstream patch immediately to prevent potential data exfiltration.