EIP-2026-104242

This is a functional exploit for an authenticated SQL injection vulnerability in ERPNext 12.14.0. It leverages unsanitized 'or_filters' and 'filters' parameters in the 'frappe.model.db_query.get_list' function to perform time-based blind SQL injection, retrieve admin reset tokens, and reset the admin password.