Django 2.2-2.2.27, 3.2-3.2.12, 4.0-4.0.3 - SQL Injection via QuerySet Column Alias Dictionary Expansion
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2022-28346. PoCs published by DeEpinGh0st, YouGina, kamal-marouane.
AI-analyzed exploit summary This repository contains a working proof-of-concept for CVE-2022-28346, demonstrating a SQL injection vulnerability in Django's QuerySet.annotate() method. The exploit allows arbitrary SQL execution via crafted input to the 'field' parameter.
Description
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
Exploits (4)
This repository contains a working proof-of-concept for CVE-2022-28346, demonstrating a SQL injection vulnerability in Django's QuerySet.annotate() method. The exploit allows arbitrary SQL execution via crafted input to the 'field' parameter.
This repository contains a working proof-of-concept for CVE-2022-28346, demonstrating SQL injection in Django's QuerySet.annotate() and aggregate() methods. The exploit is set up via Docker and includes a vulnerable Django application to showcase the vulnerability.
This repository contains a Django project demonstrating CVE-2022-28346, a SQL injection vulnerability in Django's QuerySet methods. It includes a Docker setup for testing the exploit.
This repository contains a Django-based PoC for CVE-2022-28346, demonstrating a SQL injection vulnerability in Django's QuerySet.annotate(), aggregate(), and extra() methods. The PoC includes a Django project with a vulnerable endpoint that can be exploited using a crafted SQL injection payload.
References (9)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H