Chartbrew SQL injection in dashboard filter substitution
Databases connected to this chart tool can be broken into!
Summary
Dashboard variable handling in Chartbrew allows SQL injection. An unauthenticated visitor to a public or embedded chart can use URL values to read, modify, or delete data in connected databases. Versions up to and including 5.2.0 are affected.
Affected when
- public or embedded chart
- dashboard using URL-controlled variables in a SQL query
What to do
Update to Chartbrew 5.2.1 or later.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen