CVE-2022-34265 PoC — Django SQL注入漏洞

Source

https://github.com/traumatising/CVE-2022-34265

Associated Vulnerability

Title:Django SQL注入漏洞 (CVE-2022-34265)
Description:Django是Django基金会的一套基于Python语言的开源Web应用框架。该框架包括面向对象的映射器、视图系统、模板系统等。 Django 3.2.14 版本之前 3.2 版本和 4.0.6 版本之前的 4.0 版本存在SQL注入漏洞，该漏洞源于如果将不受信任的数据用作 kind/lookup_name 值，则 Trunc() 和 Extract() 数据库函数会受到 SQL 注入的影响。

Description

CVE-2022-34265 Vulnerability

Readme

# CVE-2022-34265
Vulnerability Summary

This vulnerability is due to improper string processing when executing SQL for the arguments of the functions Trunc and Extract used for date data in Django. By specifying the request parameters as is in the kind argument of Trunc or the lookup_name argument of Extract, there is a risk that arbitrary SQL minutes can be executed. By exploiting this vulnerability, a third party can send commands to the database to access unauthorized data or delete the database.

File Snapshot


 [4.0K]  /data/pocs/d685e70edbe43153aedcab7a74173da2e774823d
├── [ 537]  docker-compose.yml
├── [ 349]  Dockerfile
├── [ 393]  models.py
├── [ 505]  README.md
├── [3.1K]  settings.py
├── [ 849]  urls.py
└── [1.1K]  views.py

0 directories, 7 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!