Django - SQL injection

criticalseverity

9.8CVSS score

73.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.

Fix

Upgrade Django to version 3.2.14 or 4.0.6 or later that properly sanitizes kind/lookup_name values in Trunc() and Extract() database functions.

How to confirm it

Positive when: contains "syntax error at or near &quot;{{rand_string}}&quot" and "LINE 1: SELECT DATE_TRUNC" AND status 500

Run it with nuclei: nuclei -id CVE-2022-34265 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-34265

info:
  name: Django - SQL injection
  author: princechaddha
  severity: critical
  description: |
    An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
  remediation: |
    Upgrade Django to version 3.2.14 or 4.0.6 or later that properly sanitizes kind/lookup_name values in Trunc() and Extract() database functions.
  impact: |
    Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.
  reference:
    - https://github.com/vulhub/vulhub/tree/master/django/CVE-2022-34265
    - https://nvd.nist.gov/vuln/detail/CVE-2022-34265
    - https://www.djangoproject.com/weblog/2022/jul/04/security-releases/
    - https://docs.djangoproject.com/en/4.0/releases/security/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-34265
    cwe-id: CWE-89
    epss-score: 0.73607
    epss-percentile: 0.99472
  tags: sqli,dast,vulhub,cve,cve2022,django,vuln

variables:
  rand_string: '{{rand_text_alpha(15, "abc")}}'

http:
  - pre-condition:
      - type: dsl
        dsl:
          - 'method == "GET"'

    fuzzing:
      - part: query
        fuzz:
          - "test'{{rand_string}}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'syntax error at or near &quot;{{rand_string}}&quot'
          - 'LINE 1: SELECT DATE_TRUNC'
        condition: and

      - type: status
        status:
          - 500

References

Use this check only on systems you are authorised to test. Where the data comes from