SQL Injection Vulnerability in Lunary API

CVE-2024-7456

What is CVE-2024-7456?

A SQL injection vulnerability has been identified in the /api/v1/external-users endpoint of Lunary AI's Lunary product, specifically in version v1.4.2. The vulnerability arises from the order by clause in an SQL query that utilizes an unsanitized input through sql.unsafe. This allows attackers to construct a malicious orderByClause without any server-side validation or sanitation, which can lead to execution of arbitrary SQL commands. Successful exploitation of this vulnerability has significant potential consequences, including complete data loss, unauthorized modification, or corruption of sensitive information.

References