Apache Fineract SQL Injection Flaws

SQL injection in Apache Fineract through 1.15.0 allows a caller of the /fineract-provider/api/v1/search/advance endpoint to inject arbitrary SQL through the outStandingAmountPercentageCondition parameter, giving full confidentiality and integrity impact on the Fineract database. The issue is confirmed by the Apache oss-security advisory and by upstream fix PR #6153, which removed the weak SqlValidator check and replaced it with strict allowlist validation of that condition plus the related outstandingAmountCondition and loanDateOption values. No public exploit code and no CISA KEV entry were identified at time of analysis (EPSS 0.23%, 14th percentile); NVD scores the flaw 9.8 with PR:N, while the assessed vector uses PR:L because the /api/v1 interface normally requires authentication in hardened deployments.

Time-based blind SQL injection in Apache Fineract through 1.15.0 lets an authenticated user who already holds read access to centers or to a specific datatable inject arbitrary SQL through the orderBy, sortOrder and order query parameters of the center read endpoint (GET /api/v1/centers) and the datatable read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and /api/v1/datatables/{datatable}/{apptableId}/{datatableId}). The bug is CWE-89: caller-supplied ordering values are concatenated straight into the SQL ORDER BY clause and the pre-existing regex validation (ColumnValidator) can be bypassed; the project's own fix replaces that regex with an allowlist check against the datatable's real column headers. Exploitation is not anonymous - it requires a valid account with the relevant read permission - and because the injection is blind and time-based, bulk data extraction is slow; EPSS is 0.28% (20th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, and Apache recommends upgrading to 1.16.1.