Main Vulnerability Database Vulnerabilities #VU114764

SQL injection in Django - CVE-2025-57833

Published: September 3, 2025 / Updated: January 4, 2026

Vulnerability identifier: #VU114764

CSH Severity: High

CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-57833

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in FilteredRelation column aliases. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Affected software

Django
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
Red Hat Enterprise Linux for x86_64
SUSE Package Hub 15
openSUSE Leap
openEuler
Ubuntu
Anolis OS
Oracle Solaris
ansible-sign (Red Hat package)
python3.11-galaxy-importer (Red Hat package)
aap-metrics-utility (Red Hat package)
python3.11-pytest-plus (Red Hat package)
python3.11-ruamel-yaml (Red Hat package)
python3.11-pytest-sugar (Red Hat package)
cjson (Red Hat package)
python-django20 (Red Hat package)
python-django (Ubuntu package)
python-django (Red Hat package)
python-django
python-django-help
python3-Django
ansible-automation-platform-installer (Red Hat package)
python3.11-django-ansible-base (Red Hat package)
automation-gateway (Red Hat package)
automation-gateway-proxy (Red Hat package)
python3.11-termcolor (Red Hat package)
python-django (Debian package)
rubygem-smart_proxy_ansible (Red Hat package)
foreman-installer (Red Hat package)
foreman (Red Hat package)
python311-Django
python3-django-doc
python3-django-bash-completion
python3-django
python3x-django (Red Hat package)
python3.11-django (Red Hat package)
automation-controller (Red Hat package)
automation-hub (Red Hat package)
python3.11-galaxy-ng (Red Hat package)
rubygem-katello (Red Hat package)
satellite (Red Hat package)
rubygem-kafo (Red Hat package)
puppet-agent (Red Hat package)
rubygem-foreman_bootdisk (Red Hat package)
molecule (Red Hat package)
ansible-navigator (Red Hat package)
ansible-dev-environment (Red Hat package)
ansible-creator (Red Hat package)
python3.11-tox-ansible (Red Hat package)
python3.11-pytest-ansible (Red Hat package)
python3.11-ansible-compat (Red Hat package)
ansible-lint (Red Hat package)
ansible-dev-tools (Red Hat package)
Ansible Automation Platform
Red Hat Satellite
Red Hat OpenStack

How to mitigate CVE-2025-57833

Install updates from vendor's website.

Django - addressed in versions 4.2.24, 5.1.12, 5.2.6
ansible-sign (Red Hat package) - addressed in versions 0.1.2-1.el8ap, 0.1.2-1.el9ap
python3.11-galaxy-importer (Red Hat package) - addressed in versions 0.4.33-1.el8ap, 0.4.33-1.el9ap
aap-metrics-utility (Red Hat package) - addressed in versions 0.6.0-2.el8ap, 0.6.0-2.el9ap
python3.11-pytest-plus (Red Hat package) - addressed in versions 0.8.1-1.el8ap, 0.8.1-1.el9ap
python3.11-ruamel-yaml (Red Hat package) - addressed in versions 0.18.15-1.el8ap, 0.18.15-1.el9ap
python3.11-pytest-sugar (Red Hat package) - addressed in versions 1.1.1-1.el8ap, 1.1.1-1.el9ap
cjson (Red Hat package) - addressed in versions 1.7.18-2.el8sat, 1.7.18-2.el9sat
python-django20 (Red Hat package) - update to 2.0.13-20.el8ost
python-django (Ubuntu package) - addressed in versions 2:2.2.12-1ubuntu0.29+esm3, 2:3.2.12-2ubuntu1.21, 3:4.2.11-1ubuntu1.10, 3:4.2.18-1ubuntu1.4
python-django (Red Hat package) - addressed in versions 2.2.24-12.el9ost, 3.2.12-9.el9ost, 4.2.24-0.1.el8pc, 4.2.24-0.1.el9pc, 4.2.24-1.el9ap
python-django - addressed in versions 2.2.27-18, 4.2.15-8
python-django-help - addressed in versions 2.2.27-18, 4.2.15-8
python3-Django - addressed in versions 2.2.27-18, 4.2.15-8
Ansible Automation Platform - addressed in versions 2.4, 2.5
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.5-18.el8ap, 2.5-18.el9ap
python3.11-django-ansible-base (Red Hat package) - addressed in versions 2.5.20250924-1.el8ap, 2.5.20250924-1.el9ap
automation-gateway (Red Hat package) - addressed in versions 2.5.20250924-2.el8ap, 2.5.20250924-2.el9ap
automation-gateway-proxy (Red Hat package) - update to 2.6.6-3.el9ap
python3.11-termcolor (Red Hat package) - addressed in versions 3.1.0-1.el8ap, 3.1.0-1.el9ap
python-django (Debian package) - addressed in versions 3:3.2.25-0+deb12u1, 3:4.2.27-0+deb13u1
rubygem-smart_proxy_ansible (Red Hat package) - addressed in versions 3.5.6.1-1.el8sat, 3.5.6.1-1.el9sat
foreman-installer (Red Hat package) - addressed in versions 3.12.0.6-1.el8sat, 3.12.0.6-1.el9sat, 3.14.0.7-1.el9sat
foreman (Red Hat package) - update to 3.14.0.8-1.el9sat
python311-Django - update to 4.2.11-150600.3.30.1
python3-django-doc - update to 4.2.16-3
python3-django-bash-completion - update to 4.2.16-3
python3-django - update to 4.2.16-3
python3x-django (Red Hat package) - update to 4.2.24-1.el8ap
python3.11-django (Red Hat package) - addressed in versions 4.2.24-1.el8ap, 4.2.24-1.el9ap
automation-controller (Red Hat package) - addressed in versions 4.6.20-1.el8ap, 4.6.20-1.el9ap
automation-hub (Red Hat package) - addressed in versions 4.10.8-1.el8ap, 4.10.8-1.el9ap
python3.11-galaxy-ng (Red Hat package) - addressed in versions 4.10.8-1.el8ap, 4.10.8-1.el9ap
rubygem-katello (Red Hat package) - addressed in versions 4.14.0.14-1.el8sat, 4.14.0.14-1.el9sat
Red Hat Satellite - addressed in versions 6.15.5.5, 6.16.5.4, 6.17.5
satellite (Red Hat package) - addressed in versions 6.15.5.5-1.el8sat, 6.16.5.4-1.el8sat, 6.16.5.4-1.el9sat, 6.17.5-1.el9sat
rubygem-kafo (Red Hat package) - addressed in versions 7.4.0.1-1.el8sat, 7.4.0.1-1.el9sat
puppet-agent (Red Hat package) - addressed in versions 7.34.0-4.el8sat, 8.8.1-3.el8sat, 8.8.1-3.el9sat
Oracle Solaris - update to 11.4 SRU 86
Red Hat OpenStack - addressed in versions 16.2, 17.1
rubygem-foreman_bootdisk (Red Hat package) - update to 22.0.4-1.el9sat
molecule (Red Hat package) - addressed in versions 25.7.0-1.el8ap, 25.7.0-1.el9ap
ansible-navigator (Red Hat package) - addressed in versions 25.8.0-1.el8ap, 25.8.0-1.el9ap
ansible-dev-environment (Red Hat package) - addressed in versions 25.8.0-1.el8ap, 25.8.0-1.el9ap
ansible-creator (Red Hat package) - addressed in versions 25.8.0-1.el8ap, 25.8.0-1.el9ap
python3.11-tox-ansible (Red Hat package) - addressed in versions 25.8.0-1.el8ap, 25.8.0-1.el9ap
python3.11-pytest-ansible (Red Hat package) - addressed in versions 25.8.0-1.el8ap, 25.8.0-1.el9ap
python3.11-ansible-compat (Red Hat package) - addressed in versions 25.8.1-1.el8ap, 25.8.1-1.el9ap
ansible-lint (Red Hat package) - addressed in versions 25.8.2-1.el8ap, 25.8.2-1.el9ap
ansible-dev-tools (Red Hat package) - addressed in versions 25.8.3-1.el8ap, 25.8.3-1.el9ap

Links to Public Exploits and PoC-codes

External References

https://www.djangoproject.com/weblog/2025/sep/03/security-releases/