CVE-2021-35042

CVE-2021-35042: Django SQL注入漏洞 I. 概述 Django 是一个开源的 Web 应用程序框架，使用 Python 编写，基于 MVC（Model - View - Controller）模型构建。它最初是为了管理由 Lawrence 出版集团拥有的新闻内容网站而构建的，是一个 CMS（内容管理系统）软件。 Django 3.1.x - 3.1.13 和 3.2.x - 3.2.5 版本存在 SQL 注入漏洞。 导致此漏洞的原因是 QuerySet.orderby 中对用户可控输入数据的过滤功能不足以防御 SQL...

Django: Django: SQL injection via crafted column aliases in QuerySet.order_by()

A flaw was found in Django. A remote attacker could exploit a SQL injection vulnerability in the .QuerySet.orderby method. This occurs when column aliases containing periods are used, and the same alias is also present in FilteredRelation via a specially crafted dictionary. Successful exploitatio...

Django 安全漏洞

Django is a set of open-source web framework based on the Python language, developed by the Django Foundation. This framework includes an object-oriented mapper, view system, template system, etc. Versions prior to Django 6.0.2, 5.2.11, and 4.2.28 have security vulnerabilities. These...

Django QuerySet.order_by - SQL Injection

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 contain a SQL injection caused by untrusted input in QuerySet.orderby, letting attackers execute arbitrary SQL commands, exploit requires attacker to control orderby input. id: CVE-2021-35042 info: name: Django QuerySet.orderby - SQL Injection...

BIT-DJANGO-2021-35042

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...