Lotus: SQL injection via stacked statements in custom metric queries
Summary
Lotus, an open-source pricing and billing engine, contains an SQL injection flaw (CWE-89) in versions through 0.10.2. An authenticated organization user can append further SQL statements to custom metric queries sent to POST /app/metrics/, because validation only checks the first statement. This can allow reading or modifying data across all tenants of the instance. The CNA lists a CVSS v4.0 base score of 8.7 (High).
Affected
- Lotus (uselotus/lotus) 0 through 0.10.2 according to the CNA record
- VulDB also lists 0.10.0, 0.10.1 and 0.10.2
Fixed in
Unknown. No vendor advisory or fixed version was found at the time of writing.
Workaround
Unknown. No vendor workaround has been published. Interim measures until a fix is available:
- Restrict who can create accounts and organizations, and review existing accounts and API keys.
- Keep the Lotus application and its admin interfaces off the public internet, behind VPN or an access proxy.
- Run the application's database role with least privilege.
Exploitation
- Not known to be exploited in the wild at the time of writing.
- A public technical write-up by the finder exists; its content was not verified.
- Exploitation requires a valid login, but a low-privileged account is sufficient.
Our recommendation
- Check whether Lotus is used in your environment, including self-hosted instances. If it is only used through a hosted service, the vendor applies the fix.
- Restrict access to the Lotus application and its admin interfaces to trusted networks.
- Review accounts and API keys, and remove unneeded users.
- Monitor database logs and requests to /app/metrics/ for unusual statements.
- Plan an upgrade as soon as a fixed release is confirmed; check the upstream repository and the vendor directly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics www.vulncheck.com
- Lotus GitHub repository github.com
- Affected code: billable_metrics.py at tag 0.10.2 github.com
- Finder's technical write-up hackmd.io
- VulDB entry 425273 vuldb.com
- HOL Guard CVE summary CVE-2026-115330 hol.org
- Lotus GitHub releases github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:44.
Original description (NVD)
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.