CyberRota Analysis
AI-GeneratedOpenMeter is vulnerable to a stored SQL injection that allows an attacker to inject malicious values into the usageAttribution.key or usageAttribution.subjectKeys fields when creating or updating a customer. This vulnerability can lead to unauthorized data manipulation during meter or event queries, potentially compromising the integrity of the database. Organizations using OpenMeter versions from v1.0.0-beta.218 to v1.0.0-beta.231 should prioritize immediate remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation. OpenMeter versions from v1.0.0-beta.218 through v1.0.0-beta.231 are affected.