CVE-2018-14574 PoC — Django 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14574.yaml

Associated Vulnerability

Title:Django 安全漏洞 (CVE-2018-14574)
Description:Django是Django软件基金会的一套基于Python语言的开源Web应用框架。该框架包括面向对象的映射器、视图系统、模板系统等。 Django 1.11.15之前的1.11.x版本和2.0.8之前的2.0.x版本中的django.middleware.common.CommonMiddleware存在开放重定向漏洞。攻击者可利用该漏洞将用户重定向到任意网站。

Description

Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 contains an open redirect vulnerability. If  django.middleware.common.CommonMiddleware and APPEND_SLASH settings are selected, and if the project has a URL pattern that accepts any path ending in a slash, an attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

File Snapshot


 id: CVE-2018-14574

info:
  name: Django - Open Redirect
  author: pikpikcu
  severity: medium
  des

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!