THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-4890

Blind SQL Injection in berriai/litellm

Reserved:2024-05-14
Published:2024-06-06
Updated:2024-06-07

Description

A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'user_id' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability by injecting malicious SQL commands through the 'user_id' parameter, leading to potential unauthorized access to sensitive information such as API keys, user information, and tokens stored in the database. The affected version is 1.27.14.



MEDIUM: 4.9CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command

Product status

Any version
affected

References

https://huntr.com/bounties/a4f6d357-5b44-4e00-9cac-f1cc351211d2

cve.org CVE-2024-4890

nvd.nist.gov CVE-2024-4890

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-4890