Apache Fineract SQL Injection Vulnerability in Offices and Dashboards API Endpoints

A SQL injection vulnerability has been identified in various API endpoints of Apache Fineract, including offices and dashboards. This vulnerability exists in versions 1.4 through 1.9, allowing authenticated attackers to inject malicious data into the query parameters of some REST API endpoints. The issue has been addressed in version 1.10.1, which introduces a SQL Validator to protect against potential SQL injection attacks.

Impact

Exploitation of this vulnerability allows for SQL injection, where an authenticated attacker can manipulate SQL queries to inject malicious payloads. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Remediation

Users are advised to upgrade to Apache Fineract version 1.10.1, which addresses this vulnerability. Instructions for upgrading can be found on the Apache Fineract website.