SQL injection in Django - CVE-2025-64459

Vulnerability identifier: #VU118131

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-64459

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data within the QuerySet.filter(), QuerySet.exclude(), and QuerySet.get(), and the class Q() when using a suitably crafted dictionary, with dictionary expansion, as the _connector argument. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Django
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Package Hub 15
openSUSE Leap
openEuler
Ubuntu
Anolis OS
Storage Defender - Resiliency Service
Maximo Application Suite - Edge Data Collector
Ansible Automation Platform
ansible-sign (Red Hat package)
python-rfc3339-validator (Red Hat package)
python3.11-ruamel-yaml-clib (Red Hat package)
python-ruamel-yaml-clib (Red Hat package)
python-jsonschema-path (Red Hat package)
python3.11-distlib (Red Hat package)
python-distlib (Red Hat package)
python3.11-subprocess-tee (Red Hat package)
python-subprocess-tee (Red Hat package)
python-pathable (Red Hat package)
python-colorama (Red Hat package)
python3.11-galaxy-importer (Red Hat package)
python-gnupg (Red Hat package)
python-sqlparse (Red Hat package)
python-isodate (Red Hat package)
python-openapi-schema-validator (Red Hat package)
python-openapi-spec-validator (Red Hat package)
python-pytest-plus (Red Hat package)
python-commonmark (Red Hat package)
python-click-help-colors (Red Hat package)
python-pathspec (Red Hat package)
python-lockfile (Red Hat package)
python-rpds-py (Red Hat package)
python-ruamel-yaml (Red Hat package)
python-openapi-core (Red Hat package)
python-referencing (Red Hat package)
python-wheel (Red Hat package)
python-mypy-extensions (Red Hat package)
automation-controller-fapolicyd (Red Hat package)
python-pytest-sugar (Red Hat package)
automation-eda-controller (Red Hat package)
python-enrich (Red Hat package)
python-onigurumacffi (Red Hat package)
python-parsley (Red Hat package)
python3.11-pluggy (Red Hat package)
python-pluggy (Red Hat package)
python-pyproject-api (Red Hat package)
receptor (Red Hat package)
python-lazy-object-proxy (Red Hat package)
python-parse (Red Hat package)
yamllint (Red Hat package)
python-iniconfig (Red Hat package)
python3.11-execnet (Red Hat package)
python-execnet (Red Hat package)
python-markupsafe (Red Hat package)
python-django (Ubuntu package)
python3-Django
python-django
python-django-help
python-bracex (Red Hat package)
ansible-runner (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
automation-gateway (Red Hat package)
python3.11-django-ansible-base (Red Hat package)
automation-platform-ui (Red Hat package)
bindep (Red Hat package)
ansible-core (Red Hat package)
python-pygments (Red Hat package)
python-werkzeug (Red Hat package)
python-termcolor (Red Hat package)
ansible-builder (Red Hat package)
python-daemon (Red Hat package)
python-django (Debian package)
python-asgiref (Red Hat package)
python3.11-pytest-xdist (Red Hat package)
python-pytest-xdist (Red Hat package)
python-filelock (Red Hat package)
python-platformdirs (Red Hat package)
python311-Django
python3-django-doc
python3-django-bash-completion
python3-django
python3.11-django (Red Hat package)
python-django (Red Hat package)
automation-controller (Red Hat package)
python3.11-galaxy-ng (Red Hat package)
automation-hub (Red Hat package)
python3.11-typing-extensions (Red Hat package)
python-typing-extensions (Red Hat package)
python-tox (Red Hat package)
python-jsonschema (Red Hat package)
python-chardet (Red Hat package)
python-cachetools (Red Hat package)
python-pbr (Red Hat package)
python-click (Red Hat package)
python-wcmatch (Red Hat package)
python3.11-pytest (Red Hat package)
python-pytest (Red Hat package)
python-more-itertools (Red Hat package)
python-rich (Red Hat package)
python-virtualenv (Red Hat package)
python3.11-gunicorn (Red Hat package)
python-gunicorn (Red Hat package)
python-black (Red Hat package)
python3.11-pytest-ansible (Red Hat package)
ansible-lint (Red Hat package)
ansible-navigator (Red Hat package)
ansible-dev-tools (Red Hat package)
molecule (Red Hat package)
python3.11-ansible-compat (Red Hat package)
ansible-creator (Red Hat package)
python3.11-tox-ansible (Red Hat package)
python-ansible-compat (Red Hat package)
python-tox-ansible (Red Hat package)
python-pytest-ansible (Red Hat package)
ansible-dev-environment (Red Hat package)
python-jsonschema-specifications (Red Hat package)

Install updates from vendor's website.

Django - addressed in versions 4.2.26, 5.1.14, 5.2.8
Ansible Automation Platform - addressed in versions 2.5, 2.6
Maximo Application Suite - Edge Data Collector - addressed in versions 8.11.24, 9.0.16, 9.1.6
ansible-sign (Red Hat package) - addressed in versions 0.1.4-1.el8ap, 0.1.4-1.el9ap, 0.1.4-2.el10ap
python-rfc3339-validator (Red Hat package) - update to 0.1.4-2.el10ap
python3.11-ruamel-yaml-clib (Red Hat package) - addressed in versions 0.2.15-1.el8ap, 0.2.15-1.el9ap
python-ruamel-yaml-clib (Red Hat package) - update to 0.2.15-2.el10ap
python-jsonschema-path (Red Hat package) - update to 0.3.4-2.el10ap
python3.11-distlib (Red Hat package) - addressed in versions 0.4.0-1.el8ap, 0.4.0-1.el9ap
python-distlib (Red Hat package) - update to 0.4.0-2.el10ap
python3.11-subprocess-tee (Red Hat package) - addressed in versions 0.4.2-1.el8ap, 0.4.2-1.el9ap
python-subprocess-tee (Red Hat package) - update to 0.4.2-2.el10ap
python-pathable (Red Hat package) - update to 0.4.3-2.el10ap
python-colorama (Red Hat package) - update to 0.4.6-13.el10
python3.11-galaxy-importer (Red Hat package) - addressed in versions 0.4.36-2.el8ap, 0.4.36-2.el9ap
python-gnupg (Red Hat package) - update to 0.5.2-2.el10ap
python-sqlparse (Red Hat package) - update to 0.5.3-3.el10ap
python-isodate (Red Hat package) - update to 0.6.1-3.el10ap
python-openapi-schema-validator (Red Hat package) - update to 0.6.2-2.el10ap
python-openapi-spec-validator (Red Hat package) - update to 0.7.1-2.el10ap
python-pytest-plus (Red Hat package) - update to 0.8.1-2.el10ap
python-commonmark (Red Hat package) - update to 0.9.1-7.el10ap
python-click-help-colors (Red Hat package) - update to 0.9.4-2.el10ap
python-pathspec (Red Hat package) - update to 0.12.1-5.el10
python-lockfile (Red Hat package) - update to 0.12.2-3.el10ap
python-rpds-py (Red Hat package) - update to 0.18.1-2.el10ap
python-ruamel-yaml (Red Hat package) - update to 0.18.15-2.el10ap
python-openapi-core (Red Hat package) - update to 0.19.1-2.el10ap
python-referencing (Red Hat package) - update to 0.36.2-2.el10ap
python-wheel (Red Hat package) - update to 0.41.2-5.el10
python-mypy-extensions (Red Hat package) - update to 1.0.0-2.el10ap
automation-controller-fapolicyd (Red Hat package) - addressed in versions 1.0-5.el8ap, 1.0-5.el9ap
python-pytest-sugar (Red Hat package) - update to 1.1.1-2.el10ap
automation-eda-controller (Red Hat package) - addressed in versions 1.1.14-1.el8ap, 1.1.14-1.el9ap, 1.2.3-1.el9ap
python-enrich (Red Hat package) - update to 1.2.7-3.el10ap
python-onigurumacffi (Red Hat package) - update to 1.3.0-2.el10ap
python-parsley (Red Hat package) - update to 1.3-4.el10ap
python3.11-pluggy (Red Hat package) - addressed in versions 1.6.0-1.el8ap, 1.6.0-1.el9ap
python-pluggy (Red Hat package) - update to 1.6.0-2.el10ap
python-pyproject-api (Red Hat package) - update to 1.6.1-2.el10ap
receptor (Red Hat package) - addressed in versions 1.6.2-1.el8ap, 1.6.2-1.el9ap, 1.6.2-2.el10ap
python-lazy-object-proxy (Red Hat package) - update to 1.10.0-2.el10ap
python-parse (Red Hat package) - update to 1.20.1-2.el10ap
yamllint (Red Hat package) - update to 1.35.1-2.el10ap
python-iniconfig (Red Hat package) - update to 2.0.0-2.el10ap
python3.11-execnet (Red Hat package) - addressed in versions 2.1.2-1.el8ap, 2.1.2-1.el9ap
python-execnet (Red Hat package) - update to 2.1.2-2.el10ap
python-markupsafe (Red Hat package) - update to 2.1.5-2.el10ap
python-django (Ubuntu package) - addressed in versions 2:2.2.12-1ubuntu0.29+esm5, 2:3.2.12-2ubuntu1.23, 3:4.2.11-1ubuntu1.12, 3:4.2.18-1ubuntu1.6, 3:5.2.4-1ubuntu2.1
python3-Django - addressed in versions 2.2.27-20, 4.2.15-10
python-django - addressed in versions 2.2.27-20, 4.2.15-10
python-django-help - addressed in versions 2.2.27-20, 4.2.15-10
python-bracex (Red Hat package) - update to 2.4-2.el10ap
ansible-runner (Red Hat package) - addressed in versions 2.4.2-1.el8ap, 2.4.2-1.el9ap, 2.4.2-2.el10ap
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.5-20.el8ap, 2.5-20.el9ap
automation-gateway (Red Hat package) - addressed in versions 2.5.20251210-1.el8ap, 2.5.20251210-1.el9ap, 2.6.20251210-2.el9ap
python3.11-django-ansible-base (Red Hat package) - addressed in versions 2.5.20251210-1.el8ap, 2.5.20251210-1.el9ap, 2.6.20251210-1.el9ap
automation-platform-ui (Red Hat package) - update to 2.6.4-1.el9ap
bindep (Red Hat package) - addressed in versions 2.13.0-1.el8ap, 2.13.0-1.el9ap, 2.13.0-2.el10ap
ansible-core (Red Hat package) - update to 2.16.14-3.el10ap
python-pygments (Red Hat package) - update to 2.18.0-1.el10
python-werkzeug (Red Hat package) - update to 3.0.3-2.el10ap
python-termcolor (Red Hat package) - update to 3.1.0-2.el10ap
ansible-builder (Red Hat package) - addressed in versions 3.1.1-1.el8ap, 3.1.1-1.el9ap, 3.1.1-2.el9ap, 3.1.1-2.el10ap
python-daemon (Red Hat package) - update to 3.1.2-2.el10ap
python-django (Debian package) - addressed in versions 3:3.2.25-0+deb12u1, 3:4.2.27-0+deb13u1
python-asgiref (Red Hat package) - update to 3.7.2-2.el10ap
python3.11-pytest-xdist (Red Hat package) - addressed in versions 3.8.0-1.el8ap, 3.8.0-1.el9ap
python-pytest-xdist (Red Hat package) - update to 3.8.0-2.el10ap
python-filelock (Red Hat package) - update to 3.13.1-2.el10ap
python-platformdirs (Red Hat package) - update to 4.2.0-2.el10ap
python311-Django - update to 4.2.11-150600.3.41.1
python3-django-doc - update to 4.2.16-4
python3-django-bash-completion - update to 4.2.16-4
python3-django - update to 4.2.16-4
python3.11-django (Red Hat package) - addressed in versions 4.2.26-1.el8ap, 4.2.26-1.el9ap, 4.2.26-2.el9ap
python-django (Red Hat package) - update to 4.2.26-2.el10ap
automation-controller (Red Hat package) - addressed in versions 4.6.23-1.el8ap, 4.6.23-1.el9ap, 4.7.6-1.el9ap
python3.11-galaxy-ng (Red Hat package) - addressed in versions 4.10.10-1.el8ap, 4.10.10-1.el9ap, 4.11.4-1.el9ap
automation-hub (Red Hat package) - addressed in versions 4.10.10-1.el8ap, 4.10.10-1.el9ap, 4.11.4-1.el9ap
python3.11-typing-extensions (Red Hat package) - addressed in versions 4.15.0-1.el8ap, 4.15.0-1.el9ap
python-typing-extensions (Red Hat package) - update to 4.15.0-2.el10ap
python-tox (Red Hat package) - update to 4.15.1-2.el10ap
python-jsonschema (Red Hat package) - update to 4.21.1-2.el10ap
python-chardet (Red Hat package) - update to 5.2.0-3.el10ap
python-cachetools (Red Hat package) - update to 5.3.2-2.el10ap
python-pbr (Red Hat package) - update to 6.0.0-3.el10ap
python-click (Red Hat package) - update to 8.1.7-2.el10ap
python-wcmatch (Red Hat package) - update to 8.5-2.el10ap
python3.11-pytest (Red Hat package) - addressed in versions 9.0.1-1.el8ap, 9.0.1-1.el9ap
python-pytest (Red Hat package) - update to 9.0.1-2.el10ap
python-more-itertools (Red Hat package) - update to 10.2.0-2.el10ap
python-rich (Red Hat package) - update to 13.1.0-2.el10ap
python-virtualenv (Red Hat package) - update to 20.25.1-2.el10ap
python3.11-gunicorn (Red Hat package) - addressed in versions 23.0.0-1.el8ap, 23.0.0-1.el9ap
python-gunicorn (Red Hat package) - update to 23.0.0-2.el10ap
python-black (Red Hat package) - update to 24.4.2-3.el10ap
python3.11-pytest-ansible (Red Hat package) - addressed in versions 25.12.0-1.el8ap, 25.12.0-1.el9ap
ansible-lint (Red Hat package) - addressed in versions 25.12.0-1.el8ap, 25.12.0-1.el9ap, 25.12.0-2.el10ap
ansible-navigator (Red Hat package) - addressed in versions 25.12.0-1.el8ap, 25.12.0-1.el9ap, 25.12.0-2.el9ap, 25.12.0-2.el10ap
ansible-dev-tools (Red Hat package) - addressed in versions 25.12.0-1.el8ap, 25.12.0-1.el9ap, 25.12.0-2.el10ap
molecule (Red Hat package) - addressed in versions 25.12.0-1.el8ap, 25.12.0-1.el9ap, 25.12.0-2.el10ap
python3.11-ansible-compat (Red Hat package) - addressed in versions 25.12.0-1.el8ap, 25.12.0-1.el9ap
ansible-creator (Red Hat package) - addressed in versions 25.12.0-1.el8ap, 25.12.0-1.el9ap, 25.12.0-2.el9ap, 25.12.0-2.el10ap
python3.11-tox-ansible (Red Hat package) - addressed in versions 25.12.0-1.2.el8ap, 25.12.0-1.2.el9ap
python-ansible-compat (Red Hat package) - update to 25.12.0-2.el10ap
python-tox-ansible (Red Hat package) - update to 25.12.0-2.el10ap
python-pytest-ansible (Red Hat package) - update to 25.12.0-2.el10ap
ansible-dev-environment (Red Hat package) - addressed in versions 25.12.2-1.1.el8ap, 25.12.2-1.1.el9ap, 25.12.2-2.el10ap
python-jsonschema-specifications (Red Hat package) - update to 2023.12.1-2.el10ap

• Exploit #12221 - CVE-2025-64459-Poc (January 4, 2026)
• Exploit #12172 - Django 5.1.13 - SQL Injection (December 4, 2025)

• https://www.djangoproject.com/weblog/2025/nov/05/security-releases/

• Multiple vulnerabilities in Django
• Ubuntu update for python-django
• openEuler 22.03 LTS SP4 update for python-django
• openEuler 22.03 LTS SP3 update for python-django
• openEuler 24.03 LTS SP2 update for python-django
• openEuler 24.03 LTS SP1 update for python-django
• openEuler 24.03 LTS update for python-django
• SUSE update for python-Django
• Anolis OS update for python-django
• Multiple vulnerabilities in Ansible Automation Platform 2.5 packages
• SQL injection in Ansible Automation Platform 2.6 packages
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.6
• Multiple vulnerabilities in IBM Edge Data Collector
• openEuler 20.03 LTS SP4 update for python-django
• Debian update for python-django
• Debian update for python-django
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service