Description
OpenPanel before 3.0.0 contains an unauthenticated ClickHouse SQL injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Openpanel-dev | openpanel | < 3.0.0 | 3.0.0 |