LiveActive security incident?Get immediate response
CVE Record

CVE-2018-14874: An issue was discovered in the Armor module in Polaris FT Intellect Core Banking 9.7.1.

An issue was discovered in the Armor module in Polaris FT Intellect Core Banking 9.7.1. Input passed through the code parameter in three pages as collaterals/colexe3t.jsp and /references/refsuppu.jsp and /references/refbranu.jsp is mishandled before being used in SQL queries, allowing SQL injection with an authenticated session.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2018-14874 is an authenticated SQL injection issue in the Armor module of Polaris FT Intellect Core Banking 9.7.1. A logged-in user could cause unsafe database query handling through a code parameter on several JSP pages. For a core banking platform, this should be treated as high business risk where the affected version is present.

Executive priority

Treat as a high-priority validation item for banks or service providers using this platform. The main urgency is determining whether the affected version exists in production and whether vendor remediation is available. Do not assume active exploitation from the provided sources.

Technical view

The CVE states that the code parameter is mishandled before use in SQL queries across collaterals/colexe3t.jsp, /references/refsuppu.jsp, and /references/refbranu.jsp. The vulnerability requires an authenticated session. Public source data does not provide CVSS, CWE, patch details, or vendor mitigation instructions.

Likely exposure

Exposure is likely limited to organizations running Polaris FT Intellect Core Banking 9.7.1 with the Armor module and authenticated access to the affected JSP routes. The source bundle does not identify other versions, cloud exposure, CPEs, or deployment defaults.

Exploitation context

The source bundle does not show CISA KEV listing or confirmed active exploitation. The public reference describes an error-based SQL injection, but available CVE metadata only supports authenticated SQL injection, not unauthenticated compromise or active exploitation in the wild.

Researcher notes

Evidence is narrow: one CVE description and one public blog reference. No CVSS vector, CWE, CPE, patch version, or official vendor advisory is included. Keep findings scoped to authenticated SQL injection in the named pages and avoid extrapolating to other Intellect versions.

Mitigation direction

  • Identify any Polaris FT Intellect Core Banking 9.7.1 deployments.
  • Check vendor guidance for fixed versions or approved remediation.
  • Restrict access to affected authenticated application areas where possible.
  • Monitor database and application logs for suspicious query errors.
  • Apply vendor-approved patches or compensating controls after validation.

Validation and detection

  • Confirm whether the Armor module is deployed.
  • Check whether the three listed JSP routes are accessible.
  • Verify affected systems require authenticated sessions.
  • Review logs for unusual errors around the code parameter.
  • Document version, exposure path, and remediation status.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-14874 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.