CVE-2020-7471 PoC — Django SQL注入漏洞

Source

Associated Vulnerability

Description

PoC for the SQL injection vulnerability in PostgreSQL with Django, found in Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3

Readme

# CVE-2020-7471-PoC (Django)
PoC for the SQL injection vulnerability in PostgreSQL with Django, found in Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3

The class `django.contrib.postgres.aggregates.StringAgg` for using the PostgreSQL STRING_AGG function had a SQL injection vulnerability. It is 
possible to embed an arbitrary query in the value passed to the delimiter parameter at initialization.

The query is injected through a form in this Django app.
Query used for SQL injection: `-') AS "mydefinedname" FROM "cve_src_example" GROUP BY "cve_src_example"."label" LIMIT 1 OFFSET 1 -- `


### Django Version used: Django 3.0.2
### PostgreSQL version used: 9.6.16

File Snapshot

 [4.0K]  /data/pocs/fa3b59c5e54e776caef94f8cc4db3218db81fac1
├── [ 689]  README.md
├── [1.6K]  requirements.txt
└── [1.0K]  views.py

0 directories, 3 files

Remarks