Skip to content

Frappe LMS SQL Injection Issue on People Page

Moderate
pateljannat published GHSA-wvq3-3wvp-6x63 Sep 20, 2023

Package

lms (frappe)

Affected versions

1.0.0

Patched versions

1.0.0

Description

Impact

On the People Page of LMS, there was an SQL Injection vulnerability.

Patches

The issue has been fixed. Users won't face this issue if they are using the latest main branch of the app.

This issue was reported by Muztahidul Islam Tanim - muztahidul@gmail.com

Severity

Moderate
6.3
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

CVE ID

CVE-2023-42807

Weaknesses