CVE-2024-5225

CVSS V2 None CVSS V3 None

Description

An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidated `api_key` parameter directly into the query, making it susceptible to SQL Injection if the `api_key` contains malicious data. This issue affects the latest version of the repository. Successful exploitation of this vulnerability could lead to unauthorized access, data manipulation, exposure of confidential information, and denial of service (DoS).

Overview

CVE ID
CVE-2024-5225

Assigner
@huntr_ai

Vulnerability Status
PUBLISHED

Published Version
2024-06-06T18:19:48.938Z

Last Modified Date
2024-06-06T20:15:18.960Z

Weakness Enumerations

CWE	URL
CWE-89	http://cwe.mitre.org/data/definitions/89.html

References

Reference URL	Reference Tags
https://huntr.com/bounties/491e4884-0306-4cd4-8fe2-9a19de33bf5c

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-5225
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5225

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 03:19:14				Added to TrackCVE