GitHub Advisoryadvisory · PyPI

GHSA-pghf-347x-c2gj SQL Injection via in django-debug-toolbar

HIGH Published 2021-04-16 Modified 2024-09-13 Official page ↗
Aliases
CVE-2021-30459
Ecosystem
PyPI
Packages
django-debug-toolbar
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2021-04-14

Affected packages

• PyPI django-debug-toolbar: >= 0.10.0, < 1.11.1 → fixed in 1.11.1 • PyPI django-debug-toolbar: >= 2.0a1, < 2.2.1 → fixed in 2.2.1 • PyPI django-debug-toolbar: >= 3.0a1, < 3.2.1 → fixed in 3.2.1

Description

Impact With Django Debug Toolbar attackers are able to execute SQL by changing the `raw_sql` input of the SQL explain, analyze or select forms and submitting the form. NOTE: This is a high severity issue for anyone using the toolbar in a production environment. Generally the Django Debug Toolbar team only maintains the latest version of django-debug-toolbar, but an exception was made because of the high severity of this issue. Patches Please upgrade to one of the following versions, depending on the major version you're using: • Version 1.x: django-debug-toolbar 1.11.1 • Version 2.x: django-debug-toolbar 2.2.1 • Version 3.x: django-debug-toolbar 3.2.1 For more information If you have any questions or comments about this advisory: • Open an issue in the django-debug-toolbar repo (Please NO SENSITIVE INFORMATION, send an email instead!) • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2021-30459 A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References