6.4
Medium
CVE-2024-5225 An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs`…
Description
An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidated `api_key` parameter directly into the query, making it susceptible to SQL Injection if the `api_key` contains malicious data. This issue affects the latest version of the repository. Successful exploitation of this vulnerability could lead to unauthorized access, data manipulation, exposure of confidential information, and denial of service (DoS).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| berriai/litellm | Versions not published |
References
- huntr.com huntr.com
Timeline
- Published
- Last modified
Other CVEs of berriai/litellm
The 15 CVEs of berriai/litellm →
CVE-2024-6825
BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution
8.8
High
CVE-2024-10188
A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service…
7.5
High
CVE-2025-0628
An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm
8.1
High
CVE-2025-0330
In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error…
7.5
High