SQL Injection by Default in Grafana (HTB — Jupiter)

SQL Injection by Default in Grafana (HTB — Jupiter)

Introduction

Over the past several years, we’ve seen a lot of people using powerful visualization and graphing tools like Grafana. You can use Grafana in a standalone mode as its own web application, but it also possible to integrate Grafana into an existing application to allow users to create their own graphs and charts. There is a known problem with Grafana that it allows raw sql to be passed to any …

ethical hacking grafana hackthebox pentesting red team