Executive brief
Frappe is a popular web application framework used to build enterprise software and business applications. An SQL injection vulnerability in the framework could allow attackers to access sensitive information from the underlying database without proper authorization. This affects all applications built on vulnerable versions of Frappe.
Technical details
Frappe Framework contains an SQL injection vulnerability (CWE-89) caused by improper input validation that fails to sanitize user-supplied data before incorporating it into database queries. The vulnerability is network-reachable and requires no authentication or user interaction to exploit. An attacker can craft malicious input to bypass validation checks, inject arbitrary SQL commands, and extract sensitive data from the application's database. Patches are available in version 14.89.0 and 15.51.0.
Affected products
- Frappe Frappe before 14.89.0, 15.0.0 before 15.51.0
Timeline
- 2025-03-25: disclosed
- 2025-03-25: patched: Versions 14.89.0 and 15.51.0 released with patches