Fineract
Monthly
Time-based blind SQL injection in Apache Fineract through 1.15.0 lets an authenticated user who already holds read access to centers or to a specific datatable inject arbitrary SQL through the orderBy, sortOrder and order query parameters of the center read endpoint (GET /api/v1/centers) and the datatable read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and /api/v1/datatables/{datatable}/{apptableId}/{datatableId}). The bug is CWE-89: caller-supplied ordering values are concatenated straight into the SQL ORDER BY clause and the pre-existing regex validation (ColumnValidator) can be bypassed; the project's own fix replaces that regex with an allowlist check against the datatable's real column headers. Exploitation is not anonymous - it requires a valid account with the relevant read permission - and because the injection is blind and time-based, bulk data extraction is slow; EPSS is 0.28% (20th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, and Apache recommends upgrading to 1.16.1.
SQL injection in Apache Fineract through 1.15.0 allows a caller of the /fineract-provider/api/v1/search/advance endpoint to inject arbitrary SQL through the outStandingAmountPercentageCondition parameter, giving full confidentiality and integrity impact on the Fineract database. The issue is confirmed by the Apache oss-security advisory and by upstream fix PR #6153, which removed the weak SqlValidator check and replaced it with strict allowlist validation of that condition plus the related outstandingAmountCondition and loanDateOption values. No public exploit code and no CISA KEV entry were identified at time of analysis (EPSS 0.23%, 14th percentile); NVD scores the flaw 9.8 with PR:N, while the assessed vector uses PR:L because the /api/v1 interface normally requires authentication in hardened deployments.
SQL injection in Apache Fineract's Office Search API (GET /api/v1/offices) in all versions up to and including 1.14.0 lets an authenticated user who holds the office-view permission inject arbitrary SQL through the orderBy request parameter. Because it bypasses the ColumnValidator hardening added for CVE-2024-32838, an attacker can run time-based blind SQL injection to exfiltrate database contents and, by launching concurrent injections that hold connections open, exhaust the database connection pool to cause denial of service. No public exploit identified at time of analysis; the flaw is documented via an oss-security advisory and an upstream fix pull request (apache/fineract #6048).
Blind boolean-based SQL injection in Apache Fineract's Client Search API (GET /api/v1/clients) through version 1.14.0 lets an authenticated user who holds the view-clients permission concatenate unvalidated orderBy (and sortOrder) parameters directly into the backing SQL query. Attackers can extract arbitrary database contents one bit at a time and, on MySQL/MariaDB back ends, read arbitrary files accessible to the DB process via LOAD_FILE(). There is no public exploit identified at time of analysis, though the vendor's fix PR (#6020) ships an integration test containing a working injection payload; not listed in CISA KEV.
SQL injection in Apache Fineract's Report Execution API (the runreports endpoint) in all versions up to and including 1.14.0 lets an authenticated user holding report-run permission inject arbitrary SQL through crafted report parameter values, because those values are concatenated into the generated query without sufficient validation. This yields unauthorized read access to data well beyond what the report was scoped to expose, and by extension other database contents. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the upstream fix landed in PR #5980, which introduces a configurable InputValidator/validation-profile framework.
Authorization bypass in Apache Fineract through 1.11.0 lets an authenticated, low-privileged user access objects they should not own by supplying a manipulated identifier key (CWE-639 / IDOR), resulting in high confidentiality and integrity impact across clients, accounts, or tenants. Exploitation requires a valid Fineract account with network access to the platform's APIs (CVSS PR:L); no user interaction or elevated role is needed, so the realistic threat actors are insiders, holders of compromised credentials, or legitimate tenants in multi-tenant deployments. No public exploit code has been identified at time of analysis, and EPSS is low at 0.39% (31st percentile), making this a genuine but moderate-priority issue rather than a top-tier emergency. Fixed in 1.12.1, with 1.13.0 recommended as the latest release.
Exposure of insufficiently protected credentials in Apache Fineract through 1.11.0 allows unauthenticated remote attackers who can reach an affected instance to recover credentials, resulting in high confidentiality impact; the independent assessment rates integrity and availability as not impacted. The issue is addressed in 1.12.1, with 1.13.0 recommended as the latest release. EPSS is 0.43% (35th percentile) and no public exploit identified at time of analysis.
Weak password requirements in Apache Fineract through 1.10.1 allow attackers to more easily compromise user accounts via password guessing or brute-force attacks because the platform failed to enforce adequate password complexity and strength policies. The vendor's CVSS 4.0 vector indicates a low-privilege authenticated foothold (PR:L) with no user interaction, network reachability, and low attack complexity, resulting in high confidentiality impact and low integrity impact with a scope change. No public exploit code has been identified, and the EPSS score is 0.52% (42nd percentile), suggesting a low likelihood of exploitation at this time; upgrading to version 1.11.0 or later (1.13.0 recommended) removes the weakness.
SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.8.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.8.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Privilege Management vulnerability in Apache Fineract.8.5. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation apache fineract. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache Fineract. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, a hacker could inject SQL to read/update data for which he doesn't have authorization. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different REST end points to query domain specific entities with a Query Parameter 'orderBy' which are appended. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape with two continuous SQL parameters can cause a SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the system exposes different REST end points to query domain specific entities with a Query Parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able to inject malicious SQL into SELECT. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Time-based blind SQL injection in Apache Fineract through 1.15.0 lets an authenticated user who already holds read access to centers or to a specific datatable inject arbitrary SQL through the orderBy, sortOrder and order query parameters of the center read endpoint (GET /api/v1/centers) and the datatable read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and /api/v1/datatables/{datatable}/{apptableId}/{datatableId}). The bug is CWE-89: caller-supplied ordering values are concatenated straight into the SQL ORDER BY clause and the pre-existing regex validation (ColumnValidator) can be bypassed; the project's own fix replaces that regex with an allowlist check against the datatable's real column headers. Exploitation is not anonymous - it requires a valid account with the relevant read permission - and because the injection is blind and time-based, bulk data extraction is slow; EPSS is 0.28% (20th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, and Apache recommends upgrading to 1.16.1.
SQL injection in Apache Fineract through 1.15.0 allows a caller of the /fineract-provider/api/v1/search/advance endpoint to inject arbitrary SQL through the outStandingAmountPercentageCondition parameter, giving full confidentiality and integrity impact on the Fineract database. The issue is confirmed by the Apache oss-security advisory and by upstream fix PR #6153, which removed the weak SqlValidator check and replaced it with strict allowlist validation of that condition plus the related outstandingAmountCondition and loanDateOption values. No public exploit code and no CISA KEV entry were identified at time of analysis (EPSS 0.23%, 14th percentile); NVD scores the flaw 9.8 with PR:N, while the assessed vector uses PR:L because the /api/v1 interface normally requires authentication in hardened deployments.
SQL injection in Apache Fineract's Office Search API (GET /api/v1/offices) in all versions up to and including 1.14.0 lets an authenticated user who holds the office-view permission inject arbitrary SQL through the orderBy request parameter. Because it bypasses the ColumnValidator hardening added for CVE-2024-32838, an attacker can run time-based blind SQL injection to exfiltrate database contents and, by launching concurrent injections that hold connections open, exhaust the database connection pool to cause denial of service. No public exploit identified at time of analysis; the flaw is documented via an oss-security advisory and an upstream fix pull request (apache/fineract #6048).
Blind boolean-based SQL injection in Apache Fineract's Client Search API (GET /api/v1/clients) through version 1.14.0 lets an authenticated user who holds the view-clients permission concatenate unvalidated orderBy (and sortOrder) parameters directly into the backing SQL query. Attackers can extract arbitrary database contents one bit at a time and, on MySQL/MariaDB back ends, read arbitrary files accessible to the DB process via LOAD_FILE(). There is no public exploit identified at time of analysis, though the vendor's fix PR (#6020) ships an integration test containing a working injection payload; not listed in CISA KEV.
SQL injection in Apache Fineract's Report Execution API (the runreports endpoint) in all versions up to and including 1.14.0 lets an authenticated user holding report-run permission inject arbitrary SQL through crafted report parameter values, because those values are concatenated into the generated query without sufficient validation. This yields unauthorized read access to data well beyond what the report was scoped to expose, and by extension other database contents. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the upstream fix landed in PR #5980, which introduces a configurable InputValidator/validation-profile framework.
Authorization bypass in Apache Fineract through 1.11.0 lets an authenticated, low-privileged user access objects they should not own by supplying a manipulated identifier key (CWE-639 / IDOR), resulting in high confidentiality and integrity impact across clients, accounts, or tenants. Exploitation requires a valid Fineract account with network access to the platform's APIs (CVSS PR:L); no user interaction or elevated role is needed, so the realistic threat actors are insiders, holders of compromised credentials, or legitimate tenants in multi-tenant deployments. No public exploit code has been identified at time of analysis, and EPSS is low at 0.39% (31st percentile), making this a genuine but moderate-priority issue rather than a top-tier emergency. Fixed in 1.12.1, with 1.13.0 recommended as the latest release.
Exposure of insufficiently protected credentials in Apache Fineract through 1.11.0 allows unauthenticated remote attackers who can reach an affected instance to recover credentials, resulting in high confidentiality impact; the independent assessment rates integrity and availability as not impacted. The issue is addressed in 1.12.1, with 1.13.0 recommended as the latest release. EPSS is 0.43% (35th percentile) and no public exploit identified at time of analysis.
Weak password requirements in Apache Fineract through 1.10.1 allow attackers to more easily compromise user accounts via password guessing or brute-force attacks because the platform failed to enforce adequate password complexity and strength policies. The vendor's CVSS 4.0 vector indicates a low-privilege authenticated foothold (PR:L) with no user interaction, network reachability, and low attack complexity, resulting in high confidentiality impact and low integrity impact with a scope change. No public exploit code has been identified, and the EPSS score is 0.52% (42nd percentile), suggesting a low likelihood of exploitation at this time; upgrading to version 1.11.0 or later (1.13.0 recommended) removes the weakness.
SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.8.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.8.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Privilege Management vulnerability in Apache Fineract.8.5. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation apache fineract. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache Fineract. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, a hacker could inject SQL to read/update data for which he doesn't have authorization. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different REST end points to query domain specific entities with a Query Parameter 'orderBy' which are appended. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape with two continuous SQL parameters can cause a SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the system exposes different REST end points to query domain specific entities with a Query Parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able to inject malicious SQL into SELECT. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.