SQL Injection Vulnerability in Apache Fineract Software

CVE-2017-5663

What is CVE-2017-5663?

Apache Fineract versions 0.4.0-incubating to 0.6.0-incubating are susceptible to SQL injection attacks. Specifically, authenticated users with certain permissions can exploit the 'sqlSearch' parameter across various endpoints, allowing them to inject arbitrary SQL code into SELECT queries. This flaw arises because the input is not properly sanitized before being incorporated into the database queries. Consequently, this vulnerability could lead to unauthorized data manipulation or exposure.

References