Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2020-7471 PoC — Django SQL注入漏洞

Source
https://github.com/victomteng1997/cve-2020-7471-Time_Blind_SQLi-
Associated Vulnerability
Title:Django SQL注入漏洞 (CVE-2020-7471)
Description:Django是Django基金会的一套基于Python语言的开源Web应用框架。该框架包括面向对象的映射器、视图系统、模板系统等。 Django 1.11.28之前的1.11版本、2.2.10之前的2.2版本和3.0.3之前的3.0版本中存在SQL注入漏洞。远程攻击者可借助特制StringAgg分隔符利用该漏洞造成拒绝服务，获取信息或提升权限。
File Snapshot

 [4.0K]  /data/pocs/144823ba25d928159d00c19a3475dcb295ad1caa
├── [4.0K]  CVE-2020-7471
│   ├── [3.9K]  CVE-2020-7471.py
│   ├── [ 634]  manage.py
│   ├── [4.0K]  sqlvul_project
│   │   ├── [ 405]  asgi.py
│   │   ├── [   0]  __init__.py
│   │   ├── [4.0K]  __pycache__
│   │   │   ├── [ 174]  __init__.cpython-36.pyc
│   │   │   ├── [2.3K]  settings.cpython-36.pyc
│   │   │   ├── [1000]  urls.cpython-36.pyc
│   │   │   └── [ 560]  wsgi.cpython-36.pyc
│   │   ├── [3.2K]  settings.py
│   │   ├── [ 789]  urls.py
│   │   └── [ 405]  wsgi.py
│   └── [4.0K]  vul_app
│       ├── [  63]  admin.py
│       ├── [  88]  apps.py
│       ├── [   0]  __init__.py
│       ├── [4.0K]  migrations
│       │   ├── [ 518]  0001_initial.py
│       │   ├── [ 547]  0002_credential.py
│       │   ├── [   0]  __init__.py
│       │   └── [4.0K]  __pycache__
│       │       ├── [ 654]  0001_initial.cpython-36.pyc
│       │       ├── [ 692]  0002_credential.cpython-36.pyc
│       │       └── [ 178]  __init__.cpython-36.pyc
│       ├── [ 247]  models.py
│       ├── [4.0K]  __pycache__
│       │   ├── [ 208]  admin.cpython-36.pyc
│       │   ├── [ 167]  __init__.cpython-36.pyc
│       │   └── [ 595]  models.cpython-36.pyc
│       ├── [  60]  tests.py
│       └── [  63]  views.py
├── [ 56K]  result_sample.png
└── [1.5K]  setup.txt

7 directories, 28 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.