CyberRota Analysis
AI-GeneratedApache Fineract's Report Execution API is vulnerable to SQL Injection due to inadequate validation of report parameter values, allowing authenticated users to manipulate SQL queries and potentially access unauthorized data. This high-severity flaw affects versions up to 1.14.0 and poses significant risks to data integrity and confidentiality. Organizations using affected versions should prioritize upgrading to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run reports to inject arbitrary SQL via crafted parameter values. This can be leveraged to perform unauthorized access to data beyond what the report was designed to expose. Users are recommended to upgrade to a version containing the fix.
Related CVEs
Other vulnerabilities affecting the same vendor(s)