Skip to content

SQL injection in QuerySet.annotate(), aggregate(), and extra()

Notifications You must be signed in to change notification settings

YouGina/CVE-2022-28346

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

7 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

CVE-2022-28346

SQL injection in QuerySet.annotate(), aggregate(), and extra()

Setup:

Run ./setup.sh for initial setup

Open the docker image to initiate the database: docker exec -it {container_id} /bin/bash And run the following commands:

python manage.py makemigrations cve202228346
python manage.py migrate

Start the instances using: docker-compose up

Now open the following URL to load sample data:

http://localhost:8000/load_example_data

Then go to the vulnerable page at: http://localhost:8000/users/

Exploit the parameter at: todo

About

SQL injection in QuerySet.annotate(), aggregate(), and extra()

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published