CVE-2017-5663: SQL Injection
In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able to inject malicious SQL into SELECT queries. The 'sqlSearch' parameter on a number of endpoints is not sanitized and appended directly to the query.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-5663?
CVE-2017-5663 is a vulnerability in Apache Fineract versions 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating that allows an authenticated user with certain privileges to inject malicious SQL into SELECT queries.
What is the severity of CVE-2017-5663?
CVE-2017-5663 has a severity rating of 8.8 (high).
How does CVE-2017-5663 affect Apache Fineract?
CVE-2017-5663 affects Apache Fineract versions 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating.
How can an authenticated user exploit CVE-2017-5663?
An authenticated user with client/loan/center/staff/group read permissions can exploit CVE-2017-5663 by injecting malicious SQL into SELECT queries using the 'sqlSearch' parameter on certain endpoints.
Is there a fix for CVE-2017-5663?
Yes, upgrading to a version of Apache Fineract beyond 0.6.0-incubating will fix CVE-2017-5663.