SQL Injection Vulnerability in Frappe HRMS

Frappe HRMS versions 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contain a critical SQL injection vulnerability originating from inadequate input validation on specific API endpoints. The flaw permits an authenticated user, regardless of their privilege level, to submit maliciously crafted HTTP requests that manipulate backend database queries. If exploited, this allows unauthorized access to data stored within the HRMS database. Given the nature of HRMS platforms, the data at risk typically includes personally identifiable information (PII), payroll details, and other sensitive corporate records. Organizations utilizing affected versions of Frappe HRMS should prioritize patching, as this vulnerability provides a direct pathway for data exfiltration once initial authentication is achieved.

Impact

Successful exploitation of this vulnerability allows unauthorized actors to extract data from the backend database. This impacts any organization running the affected HRMS versions, exposing internal records to potentially any authenticated user within the system. The scale of impact corresponds to the volume and sensitivity of the data housed in the HRMS instance, with potential for significant compliance and privacy ramifications.

Recommendation

• Upgrade Frappe HRMS to the patched versions immediately: 14.38.2, 15.64.0, 16.18.0 or later.
• Review web server access logs for anomalous SQL syntax (e.g., 'UNION SELECT', 'OR 1=1', '--') appearing in URI parameters or POST body data originating from authenticated sessions.
• Enforce the principle of least privilege by restricting user access to API endpoints to only those necessary for their specific roles to limit potential impact if an account is compromised.