CVE-2020-7471 PoC — Django SQL注入漏洞

Source

https://github.com/secoba/DjVul_StringAgg

Associated Vulnerability

Title:Django SQL注入漏洞 (CVE-2020-7471)
Description:Django是Django基金会的一套基于Python语言的开源Web应用框架。该框架包括面向对象的映射器、视图系统、模板系统等。 Django 1.11.28之前的1.11版本、2.2.10之前的2.2版本和3.0.3之前的3.0版本中存在SQL注入漏洞。远程攻击者可借助特制StringAgg分隔符利用该漏洞造成拒绝服务，获取信息或提升权限。

Description

Django StringAgg SQL Injection (CVE-2020-7471)

Readme

### Django CVE-2020-7471 SQLi

> CVE-2020-7471: Potential SQL injection via StringAgg(delimiter)
django.contrib.postgres.aggregates.StringAgg aggregation function was subject to SQL injection, using a suitably crafted delimiter.

### RUN

```bash
python manage.py makemigrations

python manage.py migrate

python manage.py runserver
```

### 参考
- https://www.djangoproject.com/weblog/2020/feb/03/security-releases/
- https://code.djangoproject.com/ticket/30315
- https://docs.djangoproject.com/zh-hans/2.2/_modules/django/contrib/postgres/aggregates/general/

File Snapshot


 [4.0K]  /data/pocs/ac2801fefe1df23cda916e4000af5d33e966775c
├── [4.0K]  app
│   ├── [  63]  admin.py
│   ├── [  81]  apps.py
│   ├── [   0]  __init__.py
│   ├── [4.0K]  migrations
│   │   ├── [ 887]  0001_initial.py
│   │   ├── [ 621]  0002_auto_20200213_0421.py
│   │   ├── [ 879]  0003_auto_20200213_0434.py
│   │   ├── [1.1K]  0004_auto_20200213_0443.py
│   │   └── [   0]  __init__.py
│   ├── [ 277]  models.py
│   ├── [  60]  tests.py
│   └── [ 744]  views.py
├── [4.0K]  DjVul_StringAgg
│   ├── [ 407]  asgi.py
│   ├── [   0]  __init__.py
│   ├── [3.3K]  settings.py
│   ├── [ 880]  urls.py
│   └── [ 407]  wsgi.py
├── [ 635]  manage.py
├── [ 285]  postgre-docker-compose.yml
├── [ 562]  README.md
└── [  22]  requirements.txt

3 directories, 20 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!