Apache Fineract Multiple SQL Injection Vulnerabilities

Bugtraq ID:	108291
Class:	Input Validation Error
CVE:	CVE-2018-11800 CVE-2018-11801
Remote:	Yes
Local:	No
Published:	May 09 2019 12:00AM
Updated:	May 09 2019 12:00AM
Credit:	Niels Heinen from Google.
Vulnerable:	Apache Fineract 1.2 Apache Fineract 1.0 Apache Fineract 1.1.0 Apache Fineract 0.6.0-incubating Apache Fineract 0.5.0-incubating Apache Fineract 0.4.0-incubating
Not Vulnerable:	Apache Fineract 1.3

Apache Fineract Multiple SQL Injection Vulnerabilities

Apache Fineract is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Apache Fineract version 0.4.0-incubating, 0.5.0-incubating, 0.6.0-incubating, 1.0.0, 1.1.0 and 1.2.0 are vulnerable.

Apache Fineract Multiple SQL Injection Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache Fineract Multiple SQL Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache Fineract Multiple SQL Injection Vulnerabilities

References:

• Apache Fineract Home Page (Apache)
  
• Apache Fineract Repository (Github)
  
• Apache Fineract Security Report (Apache)
  
• Apache Homepage (Apache)
  
• [CVE-2018-11800] and [CVE-2018-11801] Apache Fineract SQL Injection Vulnerabilit (Seclist)