Eloanapp Platform
Monthly
Unauthenticated SQL injection in the eLoanApp Platform's AJAX user-verification endpoint allows remote attackers to inject boolean- and time-based payloads into the POST parameter 'logina', enabling database engine discovery and query delays. The affected product is RDL Technologies eLoanApp Platform as represented by CPE cpe:2.3:a:rdl_technologies:eloanapp_platform:*:*:*:*:*:*:*:*, and the independent assessment scores this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, meaning network-reachable, unauthenticated exploitation with low confidentiality, integrity, and availability impact rather than full compromise. No public exploit identified at time of analysis, and the practical risk is moderate because blind extraction is slow and noisy, making large-scale data theft time-consuming and more detectable than error-based injection.
Unauthenticated SQL injection in the eLoanApp Platform's AJAX user-verification endpoint allows remote attackers to inject boolean- and time-based payloads into the POST parameter 'logina', enabling database engine discovery and query delays. The affected product is RDL Technologies eLoanApp Platform as represented by CPE cpe:2.3:a:rdl_technologies:eloanapp_platform:*:*:*:*:*:*:*:*, and the independent assessment scores this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, meaning network-reachable, unauthenticated exploitation with low confidentiality, integrity, and availability impact rather than full compromise. No public exploit identified at time of analysis, and the practical risk is moderate because blind extraction is slow and noisy, making large-scale data theft time-consuming and more detectable than error-based injection.