CVE-2024-9264-RCE-Exploit

Grafana의 SQL Expressions를 통한 CVE-2024-9264-RCE-Exploit Description Grafana의 원격 코드 실행RCE에 대한 개념 증명 CVE-2024-9264 이 저장소에는 Grafana의 SQL Expressions 기능의 원격 코드 실행RCE 취약점을 악용하는 Python 스크립트가 포함되어 있습니다. 불충분한 입력 검증을 악용하여, 이 익스플로잇은 공격자가 서버에서 임의의 셸 명령을 실행할 수 있게 합니다. 이는 공격자가 명령 실행을 용이하게 하기 위해 설치하고 로드할 수 있는...

CVE-2024-9264

CVE-2024-9264-RCE-Exploit in Grafana via SQL Expressions Description Proof Of Concept for Remote Code Execution in Grafana CVE-2024-9264 This repository contains a Python script that exploits a Remote Code Execution RCE vulnerability in Grafana's SQL Expressions feature. By leveraging insufficien...

CVE-2024-9264-Fixed

🛠️ CVE-2024-9264 - 수정된 Grafana RCE 익스플로잇 이것은 CVE-2024-9264 에 대한 개념 증명 익스플로잇의 수정된 버전 으로, Grafana의 치명적인 원격 코드 실행 취약점SQL 표현식 및 DuckDB를 통한입니다. 🔗 원본 권고: Grafana 보안 릴리스 ❌ 원본 PoC: 구문 오류 및 writefile의 잘못된 사용으로 인해 작동하지 않음 ✅ 이 버전은 취약한 Grafana 11.0.0 인스턴스에서 테스트되었으며 작동합니다. ✅ 이 버전에서 수정된 사항 ✅ writefile 대신...

LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection

A SQL injection vulnerability exists in the duckdbretriever component of the run-llama/llamaindex repository, specifically in llama-index-retrievers-duckdb-retriever prior to v0.4.0. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an...

PT-2026-53483

A SQL injection vulnerability exists in the duckdb retriever component of the run-llama/llama index repository, specifically in llama-index-retrievers-duckdb-retriever prior to v0.4.0. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an...

LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection

A SQL injection vulnerability exists in the duckdbretriever component of the run-llama/llamaindex repository, specifically in llama-index-retrievers-duckdb-retriever prior to v0.4.0. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an...

CVE-2024-11958 SQL Injection in run-llama/llama_index

A SQL injection vulnerability exists in the duckdbretriever component of the run-llama/llamaindex repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. Thi...

CVE-2024-11958 SQL Injection in run-llama/llama_index

A SQL injection vulnerability exists in the duckdbretriever component of the run-llama/llamaindex repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. Thi...

CVE-2024-11958: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in the duckdbretriever component of the run-llama/llamaindex repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. Thi...