Severity: important
Affected versions:
- Apache Fineract through 1.15.0
Description:
This issue affects Apache Fineract versions up to and including 1.15.0. The
Center read endpoint (GET /api/v1/centers) and the datatable entry read
endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET
/api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate
caller-supplied ordering parameters (orderBy, sortOrder, order) directly into
the SQL ORDER BY clause. The existing regex-based input validation can be
bypassed, allowing time-based blind SQL injection by any authenticated user
with read access to centers or to the targeted datatable.
Users are recommended to upgrade to 1.16.1 which fixes the issue.
Credit:
Abdullah Kareem @cyberkareem (finder)
Louis Van der Walt of Lateran Technologies @SuperUserDone (reporter)
Terence Monteiro @terencemo (remediation developer)
Victor Romero @iohacker (remediation reviewer)
References:
https://github.com/apache/fineract/pull/6230
https://github.com/apache/fineract/pull/6277
https://fineract.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-65874
