The Office Search API in Apache Fineract (GET /api/v1/offices) concatenates the orderBy request parameter directly into an SQL query without sufficient validation, allowing authenticated users with office view permissions to inject a subquery in the ORDER BY clause. This enables blind time-based SQL injection that can exfiltrate data, and because the injected query keeps the database connection occupied for its entire duration, concurrent exploitation can exhaust the application's database connection pool and result in a denial of service for other users.

Apache Software Foundation: Apache Fineract (up to and including 1.14.0) to inject arbitrary SQL through the orderBy parameter of the Office Search API. The injected query can be time-based, enabling data exfiltration, and it blocks the database connection for its entire duration, which can exhaust the connection pool and cause denial of service for other users.

The CVSS score of 8.1 indicates high severity but the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires access to the Office Search API as a user with office view permissions; the attacker can then craft a malicious orderBy value, perform a time-based blind injection, and saturate database connections to produce a denial of service.