CVE-2024-10901
CVSS 3.0 Score 9.1 of 10 (critical)
Details
Published Mar 20, 2025
CWE ID 434
Summary
CVE-2024-10901 is a significant vulnerability affecting the `POST /api/v1/editor/chart/run` web API in eosphoros-ai's db-gpt version 0.6.0. The issue enables attackers to execute arbitrary SQL queries with no access control. Malicious actors can exploit this vulnerability to perform Arbitrary File Write, potentially leading to Remote Code Execution (RCE). They can write malicious files, such as `__init__.py` in the Python's `/site-packages/` directory, to gain unauthorized code execution and compromise the victim's system.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.