This vulnerability in ERPNext versions 15.107.0 and Frappe 15.107.2 involves improper neutralization of special elements in SQL commands (CWE-89). The application uses Python's str.format() for SQL query construction without parameterization, enabling injection via the Supplier record's name (docname). Exploitation allows authenticated users with low privileges to bypass DocPerm access restrictions and execute arbitrary SQL commands, potentially exposing confidential information such as password hashes, credentials, integration tokens, and financial data. No official patch or remediation level has been provided as of the published date.

Exploitation can lead to unauthorized SQL query execution by low-privilege authenticated users, bypassing access controls and exposing sensitive database information including administrator password hash fragments and other confidential data. This compromises data confidentiality and integrity within the ERPNext system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious activity related to Supplier record modifications. Avoid using vulnerable versions in production environments if possible.