Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive_customers/inactive_customers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in get_sales_details and get_last_sales_amt, allowing an authenticated user to extract sensitive information and manipulate database queries. This issue is fixed in versions 15.116.0 and 16.23.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-17T21:16:46.610Z",
  "pubdate": "2026-08-17T21:16:46.610Z",
  "executiveSummary": "An unvalidated input vulnerability exists within ERPNext prior to versions 15.116.0 and 16.23.0, specifically in the inactive customers reporting module.\nThe flaw stems from the insecure handling of doctype filter parameters, which are directly interpolated into raw SQL queries without proper sanitization or parameterization.\nThis security deficiency allows an authenticated user with access to the reporting interface to perform SQL injection attacks against the underlying database.\nSuccessful exploitation of this vulnerability grants attackers the capability to extract sensitive information stored within the database and manipulate arbitrary database queries.\nThe risk implication is significant as it compromises the confidentiality and integrity of enterprise data managed by the ERP system.\nPrerequisites for exploitation include authenticated access to the application and navigation to the vulnerable reporting endpoint.",
  "technicalDetails": "The vulnerability resides in the erpnext/selling/report/inactive_customers/inactive_customers.py script within the ERPNext codebase.\nSpecifically, the functions get_sales_details and get_last_sales_amt accept an unvalidated doctype filter parameter from user input.\nThe root cause of the vulnerability is the unsafe string interpolation of this user-supplied parameter directly into raw SQL query structures, bypassing the framework's Object Relational Mapper (ORM) abstraction layer and query parameterization mechanisms.\nAffected software versions include all ERPNext installations prior to version 15.116.0 for the v15 branch and prior to version 16.23.0 for the v16 branch.\nExploitation requires the attacker to possess an authenticated session within ERPNext, although low-privileged user access may suffice depending on role-based permissions assigned to view the inactive customers report.\nThe attack flow proceeds as follows: First, an authenticated user crafts a malicious payload targeting the doctype filter parameter exposed by the inactive_customers.py report. Second, the HTTP request containing the injected SQL payload is processed by the backend reporting logic. Third, the unvalidated input is concatenated directly into the raw SQL execution strings inside the get_sales_details and get_last_sales_amt functions. Fourth, the database execution engine parses and executes the modified query structure, allowing the attacker to alter the query logic, perform union-based data retrieval, or execute blind SQL injection techniques.\nThe post-exploitation impact includes unauthorized data exfiltration of sensitive enterprise records, potential enumeration of database schemas, and manipulation of backend database states."
}