Affected Versions:

• Frappe — 15.72.4
• ERPNext — 15.67.0

🚀 Proof of Concept (PoC) — Error-based SQL Injection

✅ Test only on systems you own or have explicit permission to test. Do not use against production systems without consent.

❗ Payload (URL-encoded):

Example JSON Body (POST Request):

This confirms that SQL injection has been successfully executed and the current database name has been leaked.

🧪 Exploitation Scenario

1. An attacker logs into an ERPNext/Frappe instance with basic permissions (e.g., access to standard reports).
2. A crafted POST request is sent to /api/method/frappe.desk.reportview.get with a malicious order_by or group_by payload.
3. The backend improperly injects this value directly into an SQL query without sanitization.
4. The attacker sees a database error revealing injected output — confirming the injection.
5. The same technique could be chained with time-based payloads, UNION-based injection, or privilege escalation paths depending on the underlying database configuration.

🔐 Mitigation Recommendations

1. Use Parameterized Queries: All user input must be bound securely and never concatenated directly into SQL queries.
2. Strict Input Validation: Validate order_by and group_by against a known allowlist of acceptable column names before processing.
3. Escape Identifiers Properly: Use DBMS-specific escaping for column/field identifiers if dynamic usage is required.
4. Minimize Exposure: Restrict access to the /reportview.get API and report features based on user roles and trust levels.
5. Sanitize Logs: Avoid logging raw injection payloads to prevent leakage in audit systems.
6. Rate Limit API Requests: Throttle high-frequency API calls to reduce the impact of blind or error-based enumeration attempts.
7. Apply Patches: Frappe maintainers should release a patch securing this endpoint and audit other frappe.desk methods. Operators should upgrade as soon as a patch is available.

🔗 References

• Discoverer: Mohammed Aloli

  • GitHub: MoAlali
  • X (Twitter): @alaliksa_

• Frappe Framework: https://github.com/frappe/frappe

• ERPNext Project: https://github.com/frappe/erpnext

• OWASP SQL Injection Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html

📢 Disclaimer

This advisory is published for educational and defensive security research purposes only. Exploiting this vulnerability without authorization is illegal and unethical. If you're a developer or administrator of ERPNext or Frappe, apply the recommended mitigations immediately and monitor for unusual API usage.