CyberRota Analysis
AI-GeneratedOracle's OpenPanel is vulnerable due to an SQL injection flaw in the analytics filter builder, which improperly validates filter column identifiers. This allows authenticated attackers with specific credentials to execute arbitrary SQL queries, potentially bypassing project isolation and accessing sensitive analytics data and personally identifiable information (PII) from other organizations. Organizations using OpenPanel should prioritize patching this vulnerability to protect against unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inject arbitrary ClickHouse SQL to bypass project isolation and read other organizations' analytics data and profile PII via blind boolean oracle techniques.