Description
OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDate values with OR 1=1 to neutralize project_id scoping and read other tenants' analytics data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Openpanel-dev | openpanel | < 3.0.0 | 3.0.0 |
References
- GitHub Security Advisory (GHSA-7fm7-rprq-g8rm) vendor-advisory
- VulnCheck Advisory: OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts third-party-advisory