Authenticated database disclosure via report parameter injection

SQL injection in ERPNext 15.67.0 and Frappe Framework 15.72.4 allows remote authenticated users to read database data through report requests. The frappe.desk.reportview.get endpoint inserts attacker-controlled order_by and group_by values directly into an SQL query without validation or sanitization. A valid session with basic report access is required, and the demonstrated error-based technique exposes the current database name and supports broader enumeration.