CVE-2026-4889: SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies

Published Oct 6, 2026

Updated

SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an attacker to discover the platform's database engine and cause delays in database queries.

Affected Software

1 affected component

RDL Technologies eLoanApp Platform

Event History

Oct 6, 2026

CVE Published

via MITRE·08:16 AM

Data Sourced

via MITRE·08:16 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The affected endpoint is reachable through a POST request to /ajax/users.php?op=verify, and the CVSS vector indicates network-based exploitation with no privileges or user interaction required.

What can an attacker do with the documented SQL injection behavior?

The reported boolean-based and time-based SQL injection in the logina parameter can be used to identify the platform's database engine and induce delays in database queries. The supplied information does not establish database data extraction or modification.

CVE-2026-4889: SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What can an attacker do with the documented SQL injection behavior?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What can an attacker do with the documented SQL injection behavior?