A critical SQL injection vulnerability in Frappe ERPNext 15.57.5 allows unauthenticated attackers to perform unauthorized database queries and data extraction.

This is an SQL injection vulnerability located within the get_stock_balance_for() function in the stock_reconciliation.py file. The flaw allows an unauthenticated attacker to inject malicious SQL queries through the inventory_dimensions_dict parameter to exfiltrate sensitive data.

Successful exploitation of this vulnerability permits unauthorized access to the underlying database, potentially leading to the full compromise of ERP data, including financial records and inventory information. With a CVSS score of 8.2, this vulnerability represents a significant risk to data confidentiality and integrity, necessitating immediate attention to prevent potential data breaches.

Immediate Action: Review the official Frappe ERPNext repository for patch releases or backported fixes, specifically referencing commit eb22794f14351c2ff5731548c48bef0b91765c86, and apply updates as soon as they are available.

Proactive Monitoring: Monitor application logs for suspicious database query patterns or unusually long execution times that may indicate automated SQL injection attempts against the stock reconciliation module.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the inventory_dimensions_dict parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the vulnerability disclosure linked in the enrichment references.

Given the high severity and the availability of a public proof-of-concept, organizations running Frappe ERPNext 15.57.5 must treat this vulnerability with high urgency. Administrators should prioritize applying the vendor provided fix once released and restrict access to the affected endpoint until the patch is successfully deployed.