Skip to content

Latest commit

 

History

History
22 lines (11 loc) · 768 Bytes

Django -SQL注入漏洞复现(CVE-2019-14234).md

File metadata and controls

22 lines (11 loc) · 768 Bytes

Django JSONField/HStoreField SQL Injection Vulnerability (CVE-2019-14234)

复现环境:Vulhub

环境启动后,访问http://192.168.80.141:8000即可看到Django默认首页

漏洞复现

首先登陆后台http://192.168.80.141:8000/admin/,用户名密码为admina123123123

登陆后台后,进入模型Collection的管理页面http://192.168.80.141:8000/admin/vuln/collection/

image-20230830151532442

然后在GET参数中构造detail__a'b=123提交,其中detail是模型Collection中的JSONField:

127.0.0.1:8000/admin/vuln/collection/?detail__a'b=123

可见,单引号已注入成功,SQL语句报错:

image-20230830151808958