GitHub Advisoryadvisory · PyPI

GHSA-hmr4-m2h5-33qx SQL injection in Django

CRITICAL Published 2020-02-11 Modified 2024-09-20 Official page ↗
Aliases
CVE-2020-7471
Ecosystem
PyPI
Packages
Django
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2020-02-05

Affected packages

• PyPI Django: < 1.11.28 → fixed in 1.11.28 • PyPI Django: >= 2.0, < 2.2.10 → fixed in 2.2.10 • PyPI Django: >= 3.0, < 3.0.3 → fixed in 3.0.3

Description

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.

Related

Alias · CVE (1)

  • CVE-2020-7471 Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References