Executive brief
Frappe HR is an open-source human resources management system used by organizations to manage payroll and employee data. An authenticated HR User can exploit a SQL injection vulnerability in the Salary Payments Based on Payment Mode report to extract arbitrary data from the underlying database, potentially exposing sensitive employee and financial information.
Technical details
A SQL injection vulnerability exists in the Salary Payments Based on Payment Mode report (hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py). The get_conditions function constructs filter clauses from user-controlled filter parameters, and the get_data function incorporates these unsanitized clauses into a string-formatted SQL query without proper parameterization. An authenticated user with the HR User role can craft malicious filter values to inject arbitrary SQL, enabling extraction of sensitive database data. The vulnerability requires authentication and access to the report functionality. This issue is fixed in version 16.7.0 by refactoring the report to use Frappe's query builder instead of string concatenation.
Affected products
- Frappe HR before 16.7.0
Timeline
- 2026-05-11: patched
- 2026-09-17: disclosed