Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Apache Fineract, an open-source core banking platform, is affected through its Center and datatable read endpoints. An authenticated user with read access could inject SQL through ordering parameters, potentially reading data from the database beyond what they are authorized to see.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existing regex-based input validation can be bypassed, allowing time-based blind SQL injection by any authenticated user with read access to centers or to the targeted datatable. Users are recommended to upgrade to 1.16.1 which fixes the issue.
Timeline
- CVE published
- First seen by cve.now
- Record last updated
Affected versions
- Apache Software Foundation Apache Fineract
through 1.15.0