CVE-2020-7471 PoC — Django SQL注入漏洞

Source

https://github.com/secoba/DjVul_StringAgg

Associated Vulnerability

Title: Django SQL注入漏洞 (CVE-2020-7471)
Description:Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.

Description

Django StringAgg SQL Injection (CVE-2020-7471)

Readme

### Django CVE-2020-7471 SQLi

> CVE-2020-7471: Potential SQL injection via StringAgg(delimiter)
django.contrib.postgres.aggregates.StringAgg aggregation function was subject to SQL injection, using a suitably crafted delimiter.

### RUN

```bash
python manage.py makemigrations

python manage.py migrate

python manage.py runserver
```

### 参考
- https://www.djangoproject.com/weblog/2020/feb/03/security-releases/
- https://code.djangoproject.com/ticket/30315
- https://docs.djangoproject.com/zh-hans/2.2/_modules/django/contrib/postgres/aggregates/general/

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →