How ⏰💻 Hackers Dox You 😂

#Osint

🖥➡️ https://system32.ink/grafana-post-auth-duckdb-sql-injection-file-read-cve-2024-9264-exploit/

💻 Grafana Post-Auth DuckDB SQL Injection (File Read) CVE-2024-9264 Exploit 🖥

ℹ️ The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The duckdb binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions. 😐