A critical SQL injection vulnerability in Frappe ERPNext 15.57.5 allows unauthenticated remote attackers to extract sensitive database information.

The application fails to properly sanitize input in the get_rfq_containing_supplier function within the file erpnext/buying/doctype/request_for_quotation/request_for_quotation.py. An unauthenticated attacker can supply a malicious SQL query via the txt parameter to exfiltrate data from the underlying database.

Successful exploitation of this vulnerability permits unauthorized access to sensitive business data stored within the ERPNext database. Given the CVSS score of 8.2, this represents a high risk that could lead to full data compromise, loss of confidentiality, and regulatory non-compliance.

Immediate Action: Review the vendor GitHub pull request 49192 to identify the specific code fix and apply the corresponding patch to your instance immediately.

Proactive Monitoring: Monitor server logs for suspicious HTTP requests containing SQL syntax or unusual patterns in the txt parameter associated with the request_for_quotation endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in incoming URI parameters.

Public Exploit Available: Yes — a published proof-of-concept exists via the researcher's technical disclosure.

This vulnerability presents a significant risk to the confidentiality of organizational data. Administrators should prioritize patching the vulnerable function identified in the provided technical references. If an immediate update is not feasible, ensure that rigorous WAF filtering is active to block malicious injection attempts until the software can be updated.