day05-grafana-sqlexpr-lab

Day 5 – Grafana SQL Expressions → DuckDB LFI CVE-2024-9264 TL;DR: On affected Grafana 11.x builds, a logged-in Viewer can use SQL Expressions. Grafana forwards the expression to DuckDB on the server. With readtext / readblob, you can read local files LFI. We plant a flag at /opt/flag.txt. Build →...

CVE-2024-9264-in-Grafana-11.x

This repository does not have a README...

Exploit for Code Injection in Grafana

CVE-2024-9264 Authenticated RCE in Grafana v11.0 via SQL Exp...