CVE-2020-7471

CVE-2020-7471 이 저장소는 CVE-2020-7471 StringAggdelimiter를 통한 잠재적 SQL 인젝션 취약점의 환경과 POC를 제공합니다. 영향을 받는 Django 버전 1.11부터 1.11.28 미만 2.2부터 2.2.10 미만 3.0부터 3.0.3 미만 다운로드하여 사용하기 전에 다음 작업이 필요합니다: 1. 취약한 Django 버전 설치 테스트에 사용한 버전 pip install django==3.0.2 -i https://pypi.tuna.tsinghua.edu.cn/simple 2...

CVE-2020-7471

CVE-2020-7471 StringAgg 구분자 입력을 통한 SQL 인젝션 설정: 초기 설정을 위해 ./setup.sh 실행 데이터베이스를 시작하려면 도커 이미지를 열어라: docker exec -it containerid /bin/bash 그리고 다음 명령어를 실행하라: python manage.py makemigrations vulapp python manage.py migrate 다음을 사용하여 인스턴스를 시작하라: docker-compose up 이제 다음 URL을 열어 샘플 데이터를 로드하라:...

CVE-2020-7471

CVE-2020-7471 이 저장소는 CVE-2020-7471 Potential SQL injection via StringAggdelimiter 취약점의 환경과 POC를 제공합니다. 영향을 받는 django 버전 1.11부터 1.11.28까지 1.11.28 제외 2.2부터 2.2.10까지 2.2.10 제외 3.0부터 3.0.3까지 3.0.3 제외 다운로드 및 사용 전 다음과 같은 작업이 필요합니다: 1. django 취약 버전을 설치합니다. 제가 테스트한 버전은 다음과 같습니다: pip install django==3.0.2...

SUSE CVE-2020-7471

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitably crafted delimiter...

Exploit for SQL Injection in Djangoproject Django

CVE-2020-7471 这个仓库提供 CVE-2020-7471 Potential SQL injection via StringAggdelimiter 漏洞的环境和 POC 受影响的 django 版本 - 1.11 到 1.11.28（不含） - 2.2 到 2.2.10（不含） - 3.0 到 3.0.3（不含） 下载使用前需要如下操作： 1. 安装 django 漏洞版本，我测试用的是 python pip install django==3.0.2 -i https://pypi.tuna.tsinghua.edu.cn/simple 2. 参考...

Exploit for SQL Injection in Djangoproject Django

CVE-2020-7471 这个仓库提供 CVE-2020-7471 Potential SQL injection via StringAggdelimiter 漏洞的环境和 POC 受影响的 django 版本 - 1.11 到 1.11.28（不含） - 2.2 到 2.2.10（不含） - 3.0 到 3.0.3（不含） 下载使用前需要如下操作： 1. 安装 django 漏洞版本，我测试用的是 python pip install django==3.0.2 -i https://pypi.tuna.tsinghua.edu.cn/simple 2. 参考...

Exploit for SQL Injection in Djangoproject Django

CVE-2020-7471 This repository provides environments and P...

FreeBSD : Django -- potential SQL injection vulnerability (5a45649a-4777-11ea-bdec-08002728f74c)

MITRE CVE reports : Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitab...

ALPINE-CVE-2020-7471

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitably crafted delimiter...

PYSEC-2020-35

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitably crafted delimiter...

CVE-2020-7471

CVE-2020-7471 affects Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3. The issue is a SQL injection via untrusted data used as a StringAgg delimiter in contrib.postgres.aggregates.StringAgg, which can break escaping and inject SQL. Affected releases include Django’s PostgreSQL...

UBUNTU-CVE-2020-7471

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitably crafted delimiter...

Django -- potential SQL injection vulnerability

MITRE CVE reports: Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitabl...