SQL Injection in Apache Fineract Client Search API

A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view clients to inject arbitrary SQL via a crafted orderBy value. This can be leveraged to perform blind boolean-based data extraction and, on MySQL/MariaDB, to disclose arbitrary files readable by the database process via the LOAD_FILE() function. Users are recommended to upgrade to a version containing the fix

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Apache Fineract versions up to 1.14.0 contain a boolean-based SQL injection vulnerability in the Client Search API endpoint (GET /api/v1/clients). The orderBy and sortOrder parameters are concatenated directly into SQL queries without proper input validation or parameterized query usage, allowing authenticated users with client-viewing permissions to inject malicious SQL. While requiring authentication, this vulnerability (CVSS 8.1) enables attackers to extract sensitive customer data through blind boolean-based inference attacks, or on MySQL/MariaDB systems, to read arbitrary files from the server filesystem. Any organization deploying vulnerable versions of Fineract for financial services, microfinance, or customer management is at risk of confidentiality breaches and potential compliance violations.

Casky's 322 mapped skills leverage Claude AI's extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance). Practitioners using Casky will identify suspicious Client Search API queries containing SQL metacharacters or boolean logic operators in orderBy parameters, anomalous response timing patterns characteristic of blind SQL injection, and repeated conditional queries probing data existence. The platform's skills correlate CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) violations with techniques like T1592 (Gather Victim Org Information) and T1589 (Gather Victim Identity Information), surfacing findings that distinguish between legitimate sorting requests and injection attempts through parameter analysis and query pattern recognition.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-56287.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-56287

Casky has 322 skills that investigate the attack patterns behind CVE-2026-56287. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn