Lotus through version 0.10.2 harbors a classic SQL injection flaw in its custom billable metrics feature. The code accepts semicolon‐separated SQL statements in POST /app/metrics/ and enforces only a single‑statement check. Authenticated organization users can therefore inject additional statements, causing the underlying database engine to execute arbitrary SQL. This enables attackers to read or modify any data stored by the application, including information belonging to other tenants, and compromises both confidentiality and integrity of the system.

The vulnerable code is found in the Lotus application, specifically versions up to and including 0.10.2. Users who are running Lotus 0.10.2 or any earlier release are affected; all other, newer releases are not listed as vulnerable.

The CVSS score of 8.7 classifies this as a high severity flaw. EPSS data is not disclosed, and the vulnerability is not recorded in the CISA KEV catalog, suggesting limited public exploitation data to date. Exploitation requires an authenticated user with organization‑level privileges; once authenticated, an attacker can immediately construct malicious payloads. The ability to execute stacked statements across tenants magnifies the potential impact to all customers using the shared infrastructure.