Apache Fineract versions up to and including 1.15.0 are vulnerable to a time-based blind SQL injection via the Center read endpoint and datatable entry read endpoints. The vulnerability arises because user-supplied ordering parameters are concatenated directly into the SQL ORDER BY clause, bypassing existing regex validation. This flaw allows any authenticated user with read access to exploit the injection. Upgrading to version 1.16.1 addresses this issue.