SQL Injection in Apache Fineract Office Search API

A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to inject arbitrary SQL via a crafted orderBy value. This is a bypass of the ColumnValidator fix introduced for CVE-2024-32838, which does not detect bare subqueries in the ORDER BY position. This can be leveraged to perform time-based blind SQL injection for data exfiltration. Because the injected query blocks the database connection for its full duration, concurrent exploitation can exhaust the application's database connection pool, resulting in denial of service for other users. Users are recommended to upgrade to a version containing the fix.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Apache Fineract versions up to 1.14.0 contain a SQL injection vulnerability in the Office Search API's orderBy parameter that allows authenticated users to inject arbitrary SQL commands. This is a critical finding because it bypasses a previous patch (CVE-2024-32838) by exploiting bare subqueries in the ORDER BY clause—a technique that the original ColumnValidator did not adequately detect. Any organization running vulnerable versions of Fineract exposes their financial data to unauthorized access, modification, or exfiltration by authenticated attackers with office-viewing permissions, making this especially dangerous in multi-tenant financial service deployments.

Casky's 322 matching skills leverage Claude AI's extended reasoning to correlate attack patterns across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance), identifying how threat actors probe and exploit API parameters. Practitioners using Casky would observe detection findings that flag suspicious orderBy values containing SQL keywords (UNION, SELECT, WHERE in subquery contexts), abnormal query structure deviations, and parameter encoding patterns consistent with injection attempts. The platform's skill set maps these behavioral indicators to SQL injection attack chains, enabling security teams to distinguish between legitimate sorting requests and crafted payloads—particularly those designed to bypass regex-based validators that miss syntactically valid subquery constructs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-57821.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-57821

Casky has 322 skills that investigate the attack patterns behind CVE-2026-57821. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn