Executive brief
Apache Fineract is an open-source platform for financial services used to manage core banking operations. A security flaw in its client search feature allows authorized users to manipulate database queries. This could lead to the unauthorized extraction of sensitive financial data or the theft of system files from the database server, potentially compromising customer privacy and system integrity.
Technical details
A boolean-based SQL injection vulnerability exists in the Client Search API of Apache Fineract. The root cause is the unsafe concatenation of the 'orderBy' and 'sortOrder' request parameters into SQL queries without sufficient validation or parameterization. An authenticated attacker with permissions to view clients can exploit this by submitting crafted values to the 'orderBy' parameter. This allows for blind boolean-based data extraction from the database. Furthermore, on systems using MySQL or MariaDB, an attacker can potentially read arbitrary files from the underlying operating system using the LOAD_FILE() function. The issue is addressed in version 1.15.0 by implementing strict input sanitization and pattern matching for sorting parameters.
Affected products
- Apache Fineract up to and including 1.14.0
Timeline
- 2026-06-23: patched: Pull request merged into develop branch
- 2026-07-15: disclosed: Public advisory released via oss-security mailing list
- 2026-07-15: advisory: NVD publication date