CVE-2020-9402

Nuclei

SQL injection in Django

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

EIP currently links 1 Nuclei template to CVE-2020-9402.

Description

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Django

Browse PyPI / Django
GitHub Advisory1.11 to < 1.11.29 · Fixed in 1.11.29affected
2.2 to < 2.2.11 · Fixed in 2.2.11affected
3.0 to < 3.0.4 · Fixed in 3.0.4affected

Nuclei templates

1
ProjectDiscoveryHIGHDjango SQL InjectionCVSS 8.8

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allow SQL injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it is possible to break character escaping and inject malicious SQL.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Upgrade to the latest version.

WeaknessesCWE-89
Authorsgeeknik, 0x_Akoko
Template tagscvecve2020djangosqlivulhubdjangoprojectvulndast
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
Shodan: cpe:"cpe:2.3:a:djangoproject:django"
https://www.debian.org/security/2020/dsa-4705 https://github.com/vulhub/vulhub/tree/master/django/CVE-2020-9402 https://docs.djangoproject.com/en/3.0/releases/security/ https://nvd.nist.gov/vuln/detail/CVE-2020-9402 https://groups.google.com/forum/#!topic/django-announce/fLUh_pOaKrY

Source: ProjectDiscovery

References

Showing 12 of 18