CVE-2024-36039_PoC

CVE-2024-36039：PyMySQL对象注入导致SQL注入的PoC 一个完整、可复现的CVE-2024-36039 概念验证（PoC）实验室，演示了PyMySQL（版本 = 1.1.0）中的对象注入漏洞如何通过MariaDB的ODBC转义序列升级为完整的SQL注入。 ⚠️ 法律与道德声明（仅供道德使用） 本仓库仅供学术和研究目的 使用。 所提供的代码和技术不得 用于干扰任何您不拥有或未获得明确书面许可进行测试的系统。 作者/贡献者不对 因滥用此信息而导致的任何后果或损害负责。 使用本仓库即表示您同意遵守这些条款。 📖 1. 漏洞概述 CVE-2024-36039 是 PyMySQL...

PYSEC-2026-502 PyMySQL SQL Injection vulnerability

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escapedict...

ROOT-APP-PYPI-CVE-2024-36039 CVE-2024-36039 in rootio-PyMySQL - Patched by Root

Root has patched CVE-2024-36039 in the rootio-PyMySQL package for Root:PyPI. Multiple fixed versions available...

Unity Linux 20.1050e / 20.1070e Security Update: python-PyMySQL (UTSA-2026-017341)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017341 advisory. PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escapedict. Tenable has extracted the preceding...

Azure Linux 3.0 Security Update: python-PyMySQL (CVE-2024-36039)

The version of python-PyMySQL installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-36039 advisory. - PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not...

MiracleLinux 9 : python3.12-PyMySQL-1.1.0-3.el9 (AXSA:2024-9377:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-9377:02 advisory. python-pymysql: SQL injection if used with untrusted JSON input CVE-2024-36039 Tenable has extracted the preceding description block directly from the...

MiracleLinux 9 : python3.11-PyMySQL-1.0.2-2.el9 (AXSA:2024-9378:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-9378:02 advisory. python-pymysql: SQL injection if used with untrusted JSON input CVE-2024-36039 Tenable has extracted the preceding description block directly from the...

MiracleLinux 8 : python3.12-PyMySQL-1.1.0-3.el8_10 (AXSA:2024-8536:01)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2024-8536:01 advisory. python-pymysql: SQL injection if used with untrusted JSON input CVE-2024-36039 Tenable has extracted the preceding description block directly from the...

TencentOS Server 3: python3 (TSSA-2024:0310)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0310 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

TencentOS Server 4: python-PyMySQL (TSSA-2024:0920)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0920 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2024-36039 affecting package python-PyMySQL for versions less than 1.1.1-3

CVE-2024-36039 affecting package python-PyMySQL for versions less than 1.1.1-3. An upgraded version of the package is available that resolves this issue...

python3.12-PyMySQL bug fix and enhancement update

An update is available for python3.12-PyMySQL. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

python3 security update

An update is available for python3.12-PyMySQL. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...

RLSA-2024:4245 Moderate: python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

RockyLinux 8 : python3.11-PyMySQL (RLSA-2024:4244)

The remote RockyLinux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2024:4244 advisory. python-pymysql: SQL injection if used with untrusted JSON input CVE-2024-36039 Tenable has extracted the preceding description block directly from the RockyLinux...

RockyLinux 9 : python3.12-PyMySQL (RLSA-2024:9193)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:9193 advisory. python-pymysql: SQL injection if used with untrusted JSON input CVE-2024-36039 Tenable has extracted the preceding description block directly from the RockyLinux...

python3.11-PyMySQL security update

An update is available for python3.11-PyMySQL. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This package contains a pure-Python MySQL client library. The goal...

python3.12-PyMySQL security update

An update is available for python3.12-PyMySQL. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This package contains a pure-Python MySQL client library. The goal...

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.

...

Linux Distros Unpatched Vulnerability : CVE-2024-36039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escapedict. CVE-2024-36039 Note that Nessus relies ...