CVE Feed

    Dashboard / CVE / CVE-2024-7456

    CVE-2024-7456

    A SQL injection vulnerability exists in the `/api/v1/external-users` route of lunary-ai/lunary version v1.4.2. The `order by` clause of the SQL query uses `sql.unsafe` without prior sanitization, allowing for SQL injection. The `orderByClause` variable is constructed without server-side validation or sanitization, enabling an attacker to execute arbitrary SQL commands. Successful exploitation can lead to complete data loss, modification, or corruption.

    Published:Nov 1, 2024
    Last Modified:Nov 6, 2024
    EPS:Nov 1, 2024
    EPSS Score:0.18726
    CVSS Score:9.8

    Affected Products

    Vendor
    Lunary
    Product
    Lunary
    Vendor
    Lunary-ai
    Product
    Lunary-ai\/lunary

    Exploits

    https://huntr.com/bounties/bfb3015e-5642-4d94-ab49-e8b49c4e07e4https://github.com/77Philly/CVE-2024-7456scripts

    Related CVEs

    CVE-2024-5386 (CVSS 8.8) — In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token lea…
    CVE-2024-4147 (CVSS 6.5) — In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users t…
    CVE-2025-9803 (CVSS 8.8) — lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Goo…
    CVE-2025-5352 (CVSS 9.6) — A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/luna…
    CVE-2025-4779 (CVSS 6.1) — lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthentica…
    CVE-2024-11300 (CVSS 6.5) — In lunary-ai/lunary before version 1.6.3, an improper access control vulnerability exists where a user can acc…
    CVE-2024-10272 (CVSS 7.5) — lunary-ai/lunary is vulnerable to broken access control in the latest version. An attacker can view the conten…
    CVE-2024-8998 (CVSS 7.5) — A Regular Expression Denial of Service (ReDoS) vulnerability exists in lunary-ai/lunary version git f07a845. T…
    CVE-2025-0281 (CVSS 5.4) — A stored cross-site scripting (XSS) vulnerability exists in lunary-ai/lunary versions 1.6.7 and earlier. An at…
    CVE-2024-9099 (CVSS 8.1) — In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys f…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High