CyberRota Analysis
AI-GeneratedApache Fineract's Client Search API is vulnerable to a boolean-based SQL Injection due to insufficient validation of the orderBy and sortOrder parameters, allowing authenticated users to execute arbitrary SQL queries. This vulnerability can lead to unauthorized data extraction and potentially expose sensitive files on MySQL/MariaDB systems. Organizations using affected versions should prioritize upgrading to a patched release to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view clients to inject arbitrary SQL via a crafted orderBy value. This can be leveraged to perform blind boolean-based data extraction and, on MySQL/MariaDB, to disclose arbitrary files readable by the database process via the LOAD_FILE() function. Users are recommended to upgrade to a version containing the fix
Related CVEs
Other vulnerabilities affecting the same vendor(s)