SQL injection in RDL Technologies eLoanApp Platform login parameter
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
RDL Technologies eLoanApp Platform is affected from 0 before 06/10/2026. The logina POST parameter does not neutralize special SQL elements (CWE-89), so it accepts SQL injection. A remote attacker without privileges or user interaction can use boolean-based and time-based injection to discover the database engine and delay database queries.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an attacker to discover the platform's database engine and cause delays in database queries.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| RDL Technologies | eLoanApp Platform | before 06/10/2026 | 06/10/2026 | Patch available | CNA |
- eLoanApp Platform VendorRDL Technologies Affected before 06/10/2026 Fixed in 06/10/2026 Patch available CNA
Remediation
Upgrade eLoanApp Platform to 06/10/2026, the fixed version.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA eLoanApp Platform (RDL Technologies) Fixed in 06/10/2026
Timeline
- 2026-10-06 Threatist record created from CVE-2026-4889
- 2026-10-06 Alias added: GHSA-529h-q2cj-gj6w
- 2026-10-06 CISA SSVC decision points changed
- 2026-10-06 Priority changed: MEDIUM → LOW
- 2026-10-07 Priority changed: LOW → MEDIUM
References
Sources
- CVE-2026-4889 · CVE Program
- CVE-2026-4889 · NVD
- FIRST EPSS
- GHSA-529h-q2cj-gj6w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences