SQL Injection in Frappe Framework

Executive Summary

This vulnerability exists in the Frappe web application framework versions prior to 16.18.3 and 15.108.0. The issue is that the function check_safe_sql_query allowed SELECT INTO OUTFILE queries to be executed. Such queries can write database query results directly to files on the server. If a self-hosted site has improperly configured database permissions and the MySQL FILE privilege is enabled, an attacker could exploit this to write files on the server, potentially leading to unauthorized data exposure or other malicious actions.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to write arbitrary files to the server hosting the database, assuming the database permissions and MySQL FILE privileges are not properly restricted. This could lead to unauthorized data disclosure, data manipulation, or potentially further compromise of the server environment.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Frappe to version 16.18.3 or later, or 15.108.0 or later, where the issue has been fixed.

Additionally, ensure that database permissions are properly aligned and that MySQL FILE privileges are restricted to trusted users only to reduce the risk of exploitation.

Useful 0 Not Useful 0