A high-severity SQL injection vulnerability in ERPNext allows authenticated attackers to potentially compromise database integrity and access sensitive information.

The application is vulnerable to SQL injection (CWE-89) because it fails to properly neutralize special elements used in SQL commands. This vulnerability requires the attacker to have authenticated access to the system.

SQL injection is a critical vector for data theft, unauthorized modification of records, and potential service disruption. With a CVSS score of 7.6, this vulnerability poses a high risk to the business, as an attacker could extract sensitive ERP data or manipulate financial and operational records.

Immediate Action: Upgrade ERPNext to version 15.116.0 or 16.23.0, depending on the current branch, to mitigate the SQL injection risk.

Proactive Monitoring: Monitor database query logs for suspicious SQL syntax, such as UNION statements or unexpected comment characters, which may indicate attempted injection.

Compensating Controls: Utilize a Web Application Firewall (WAF) with SQL injection protection rules to inspect incoming requests and block malicious payloads.

Public Exploit Available: No (exploit_available false).

Given the sensitive nature of data managed by ERPNext, this vulnerability should be addressed immediately. Administrators must prioritize applying the provided security releases to ensure database integrity and confidentiality.