Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 and 16.20.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-10T21:17:25.593Z",
  "pubdate": "2026-08-10T21:17:25.593Z",
  "executiveSummary": "An SQL injection vulnerability exists in ERPNext prior to versions 15.109.0 and 16.20.0 within the tax rule management functionality.\nThe flaw resides in the get_tax_template function located in erpnext/accounts/doctype/tax_rule/tax_rule.py, where request-influenced parameters such as posting_date and args are dynamically concatenated or insecurely handled to construct an SQL WHERE clause.\nAn authenticated low-privilege user can leverage this weakness to inject malicious SQL commands, potentially leading to unauthorized data retrieval and the extraction of sensitive information from the underlying database.\nThe risk implication is significant as it compromises database confidentiality through standard application interfaces by bypassing input sanitization mechanisms.\nSuccessful exploitation requires authenticated access with low privileges, meaning an attacker must possess a valid user account within the ERPNext system to interact with the vulnerable endpoint.",
  "technicalDetails": "The root cause of the vulnerability is improper neutralization of special elements used in an SQL command, commonly known as SQL Injection.\nSpecifically, the vulnerable component is the get_tax_template function found in the file erpnext/accounts/doctype/tax_rule/tax_rule.py.\nDuring execution, this function processes user-controlled input derived from the request context, specifically the posting_date and args values.\nThe application insecurely incorporates these input values directly into the construction of an SQL WHERE clause without proper parameterization or adequate sanitization.\nAffected software versions include all deployments of ERPNext prior to version 15.109.0 and version 16.20.0.\nAuthentication requirements dictate that the attacker must be authenticated to the ERPNext platform.\nPrivilege requirements are minimal, as a low-privilege user account is sufficient to trigger the vulnerable function and execute the injected SQL payload.\nThe attack flow proceeds as follows: First, the authenticated low-privilege user crafts an HTTP request targeting the functionality that invokes the get_tax_template function. Second, the user injects malicious SQL syntax within the posting_date or args parameters. Third, the application unsafely interpolates these parameters into the dynamic SQL query string executed against the backend database. Fourth, the database evaluates the modified query, allowing the attacker to manipulate the logic of the WHERE clause. Finally, the application returns database query results or error messages that expose sensitive information to the attacker.\nPost-exploitation impact includes unauthorized data extraction, allowing the attacker to read confidential tables, credentials, or business data stored within the ERPNext database."
}