Vulnerability identifier: #VU24846

Vulnerability risk: Medium

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-7471

CWE-ID: CWE-89

Exploitation vector: Network

Exploits in database: 7

• September 1, 2021
  • CVE-2020-7471 (Reproduce CVE-2020-7471) [Github]
• June 3, 2021
  • CVE-2020-7471-Django (PoC for the SQL injection vulnerability in PostgreSQL with Django, found in Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3) [Github]
• September 1, 2020
  • cve-2020-7471-Time_Blind_SQLi- () [Github]
• August 10, 2020
  • CTF_CVE-2020-7471 () [Github]
• June 3, 2020
  • DjVul_StringAgg (Django StringAgg SQL Injection (CVE-2020-7471)) [Github]
  • CVE-2020-7471 (django 漏洞：CVE-2020-7471 Potential SQL injection via StringAgg(delimiter) 的漏洞环境和 POC) [Github]
  • CVE-2020-7471 (CVE-2020-7471 Potential SQL injection via StringAgg(delimiter)) [Github]

Impact: Information disclosure and data manipulation

Vulnerable software:
Django
Web applications / CMS

Vendor: Django Software Foundation