Lotus: stacked SQL in custom metrics reads or edits all tenants' data

Lotus (uselotus, open-source usage billing) through 0.10.2 lets any logged-in user, including self-registered ones, create a 'custom' metric whose custom_sql runs on the shared Postgres database. validate_custom_sql checks only the first statement (sqlparse parsed_sql[0]), so after a ';' the attacker can run any SQL. That reads or changes every tenant's data, and DB errors are echoed back, which enables extraction. The same researcher reports related injection through property_name and subscription filters, plus an org-switch authorization flaw. No fixed version has been published.

Summary written from the sources below. Check the originals before acting.