Description (CNA)
Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Frappe / Frappe CRM | affected 1.53.1 |
CWE
CWE-89
References
- https://fluidattacks.com/advisories/oz
- https://github.com/frappe/crm
- https://github.com/frappe/crm/pull/1339
ADP enrichment
No English description supplied.