Description
In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_program/loyalty_program.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expiry_date parameter.
References
github.com/...5/Frappe Framework - Multiple SQL Injection.md
github.com/...mmits/8696ba2f5d9e99c799d4aef577f72f2fae5678e7
