Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.

An attacker exploiting this SQL Injection vulnerability could execute arbitrary SQL queries against the Fineract database. This could lead to the extraction of sensitive data such as user credentials, financial records, and transaction history. Depending on the database permissions, an attacker might also be able to modify or delete data, potentially disrupting Fineract's operations. The impact is particularly severe given Fineract's use in microfinance institutions, where sensitive financial data is routinely stored and processed. Successful exploitation could result in significant financial losses and reputational damage.

Microfinance institutions and organizations utilizing Apache Fineract for financial management are at significant risk. Specifically, deployments using older, unpatched versions (0–1.8.5) are highly vulnerable. Shared hosting environments where Fineract instances are co-located with other applications should be prioritized for patching due to the potential for cross-site contamination.

• apache / server:

curl -I <fineract_url>/api/endpoint_susceptible_to_injection
# Check for SQL errors in the response headers or body

• database (mysql, postgresql):

-- Check for unusual database activity or unauthorized access attempts in audit logs
SELECT * FROM audit_log WHERE event_type = 'SQL Injection';

1. 2024-03-29Disclosure

   disclosure

1. Gereserveerd2024-01-18
2. Gepubliceerd2024-03-29
3. Gewijzigd2025-02-13
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2024-23538 is to upgrade Apache Fineract to version 1.8.5 or 1.9.0, which contain the necessary fixes. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as input validation and parameterized queries to reduce the attack surface. Web Application Firewalls (WAFs) configured with rules to detect and block SQL Injection attempts can also provide an additional layer of defense. Regularly review database access permissions to ensure they are least privilege.