Description
Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.
This issue affects Frappe CRM: 1.53.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Frappe | Frappe CRM | 1.53.1 | — |
References
- https://fluidattacks.com/advisories/oz third-party-advisory
- https://github.com/frappe/crm product
- https://github.com/frappe/crm/pull/1339 patch