CVE-2020-7471 PoC — Django SQL注入漏洞

Description

PoC for the SQL injection vulnerability in PostgreSQL with Django, found in Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3

介绍

# CVE-2020-7471-PoC (Django)
PoC for the SQL injection vulnerability in PostgreSQL with Django, found in Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3

The class `django.contrib.postgres.aggregates.StringAgg` for using the PostgreSQL STRING_AGG function had a SQL injection vulnerability. It is 
possible to embed an arbitrary query in the value passed to the delimiter parameter at initialization.

The query is injected through a form in this Django app.
Query used for SQL injection: `-') AS "mydefinedname" FROM "cve_src_example" GROUP BY "cve_src_example"."label" LIMIT 1 OFFSET 1 -- `


### Django Version used: Django 3.0.2
### PostgreSQL version used: 9.6.16

文件快照

备注