Ádám Sághy

**Name of the Vulnerable Software and Affected Versions** Apache Fineract versions prior to 1.14.1 **Description** An issue exists in the Report Execution API 'runreports' endpoint where report parameter values are incorporated into the generated SQL query without sufficient validation. This allows an authenticated user with report execution permissions to inject arbitrary SQL through crafted parameter values, potentially leading to unauthorized access to data beyond the intended scope of the report. **Recommendations** Upgrade to a version containing the fix. Restrict the use of the 'runreports' endpoint for users with excessive permissions until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Apache Fineract versions prior to 1.14.1 **Description** An authenticated user with permissions to view clients can exploit a boolean-based SQL Injection in the Client Search API endpoint '/api/v1/clients'. The issue occurs because the `orderBy` and `sortOrder` parameters are concatenated into a SQL query without sufficient validation. This allows for blind boolean-based data extraction and, specifically on MySQL or MariaDB, the disclosure of arbitrary files readable by the database process through the `LOAD FILE()` function. **Recommendations** Upgrade to a version containing the fix. As a temporary mitigation, restrict the use of the `orderBy` and `sortOrder` parameters in the '/api/v1/clients' endpoint.

**Name of the Vulnerable Software and Affected Versions** Apache Fineract versions prior to 1.14.1 **Description** An authenticated user with permissions to view offices can perform a time-based blind SQL injection via the 'Office Search API' endpoint '/api/v1/offices'. The issue occurs because the `orderBy` request parameter is concatenated into a SQL query without sufficient validation, bypassing the ColumnValidator. This allows the injection of arbitrary SQL, which can be used for data exfiltration. Additionally, because the injected queries block database connections, concurrent exploitation may exhaust the database connection pool, leading to a denial of service. **Recommendations** Upgrade to a version containing the fix. As a temporary mitigation, restrict the use of the `orderBy` parameter in the '/api/v1/offices' endpoint.

**Name of the Vulnerable Software and Affected Versions** Apache Fineract versions through 1.11.0 **Description** A flaw exists in Apache Fineract related to insufficiently protected credentials. Upgrade to version 1.13.0, the latest release, to address this issue. The issue is resolved in version 1.12.1. **Recommendations** Upgrade to version 1.13.0.

**Name of the Vulnerable Software and Affected Versions** Apache Fineract versions through 1.11.0 **Description** An authorization bypass exists in Apache Fineract due to a user-controlled key issue. This allows for potential unauthorized access. The issue is addressed in version 1.12.1, and upgrading to version 1.13.0 is recommended. **Recommendations** Upgrade to version 1.13.0 or later.