Threats tagged 'ghsa-wfxj-g749-hqjv'

OpenPanel versions prior to 3.0.0 have an unauthenticated SQL injection vulnerability in the ClickHouse database via the projectId parameter on the /live/visitors/:projectId WebSocket endpoint. This endpoint lacks session and project-access checks, allowing remote attackers to inject SQL commands. Exploitation enables attackers to read data belonging to other tenants by leveraging UNION queries or boolean count oracles. Additionally, project members can exploit a similar injection through the cohort.preview timeframe values.