Exploit for #VU24846 SQL injection in Django

Vulnerability identifier: #VU24846

Vulnerability risk: Medium

CVSSv4.0: 2.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2020-7471

CWE-ID: CWE-89

Exploitation vector: Network

Exploits in database: 7

• September 1, 2021
  • CVE-2020-7471 (Reproduce CVE-2020-7471) [Github]
• June 3, 2021
  • CVE-2020-7471-Django (PoC for the SQL injection vulnerability in PostgreSQL with Django, found in Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3) [Github]
• September 1, 2020
  • cve-2020-7471-Time_Blind_SQLi- () [Github]
• August 10, 2020
  • CTF_CVE-2020-7471 () [Github]
• June 3, 2020
  • DjVul_StringAgg (Django StringAgg SQL Injection (CVE-2020-7471)) [Github]
  • CVE-2020-7471 (django 漏洞：CVE-2020-7471 Potential SQL injection via StringAgg(delimiter) 的漏洞环境和 POC) [Github]
  • CVE-2020-7471 (CVE-2020-7471 Potential SQL injection via StringAgg(delimiter)) [Github]

Vulnerable software:
Django
Web applications / CMS

Vendor: Django Software Foundation