by Kastro
Paper/Archive/CVE-2024-7456

CVE-2024-7456

lunary-ai lunary-ai/lunary — SQL Injection in lunary-ai/lunary

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
54
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 72.7.727 × 2014.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A SQL injection vulnerability exists in the `/api/v1/external-users` route of lunary-ai/lunary version v1.4.2. The `order by` clause of the SQL query uses `sql.unsafe` without prior sanitization, allowing for SQL injection. The `orderByClause` variable is constructed without server-side validation or sanitization, enabling an attacker to execute arbitrary SQL commands. Successful exploitation can lead to complete data loss, modification, or corruption.

Affected

ProductAffectedFixed inSource
lunary-ai/lunaryunspecified – < 1.4.31.4.3CNA
lunary-ai\/lunary< 1.4.31.4.3CISA-ADP

Scores by source

@huntr_ai (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refhuntr.com/bounties/bfb3015e-5642-4d94-ab49-e8b49c4e07e4refgithub.com/lunary-ai/lunary/commit/6a0bc201181e0f4a0cc375ccf4ef0d7ae65c8a8e