A critical SQL injection vulnerability in Frappe ERPNext version 15.57.5 allows unauthenticated attackers to exfiltrate sensitive database information.

The application fails to properly sanitize the inventory_dimensions_dict parameter within the get_stock_balance function located in erpnext/stock/utils.py. This flaw permits an unauthenticated attacker to inject malicious SQL queries and extract data directly from the backend database.

The ability for an unauthenticated user to perform arbitrary database queries poses a significant risk to data confidentiality. A successful exploit could lead to the unauthorized disclosure of proprietary business data, customer records, or financial information, potentially resulting in regulatory noncompliance and severe reputational harm. Given the CVSS score of 7.5, this high-severity vulnerability must be prioritized to prevent potential data breaches.

Immediate Action: Organizations should review the referenced GitHub pull request to identify the required code changes and apply the fix to the affected erpnext/stock/utils.py file. If a formal vendor patch is not yet available, restrict access to the affected inventory endpoints until the patch is deployed.

Proactive Monitoring: Monitor database access logs for unusual query patterns, specifically those containing SQL keywords such as UNION, SELECT, or SLEEP, originating from unexpected IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection patterns targeting common ERP parameters.

Public Exploit Available: Yes, a public proof-of-concept exists via the researcher's disclosure on GitHub.

This vulnerability represents a high risk to the integrity and confidentiality of the ERPNext environment. Security teams must treat this as a priority update, leveraging the provided commit information to verify their current version and apply the necessary code-level remediation immediately to block unauthorized database access.