CyberRota Analysis
AI-GeneratedThe vulnerability exists in Capgo versions prior to 12.128.2, specifically affecting the POST /private/admin_stats endpoint, where the limit parameter is improperly validated. This SQL injection flaw allows an authenticated attacker with admin credentials to manipulate SQL queries, potentially leading to unauthorized data extraction, enumeration of dataset schemas, or denial-of-service against the analytics backend. Organizations using affected versions should prioritize patching to mitigate the risk of data exposure and service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals. An attacker with platform admin credentials can inject SQL fragments to enumerate dataset schemas, extract analytics data, or cause denial-of-service against the analytics backend.