SQL injection in Django - CVE-2025-13372

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU119042

SQL injection in Django - CVE-2025-13372

Published: December 2, 2025


Vulnerability identifier: #VU119042
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-13372
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in FilteredRelation when handling column aliases. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.


Affected software

Django
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Ubuntu
SUSE Package Hub 15
openSUSE Leap
openEuler
Oracle Solaris
python-django (Ubuntu package)
python-django (Debian package)
python311-Django
python-django
python3-Django
python-django-help

How to mitigate CVE-2025-13372

Install updates from vendor's website.

Django - addressed in versions 4.2.27, 5.1.15, 5.2.9
python-django (Ubuntu package) - addressed in versions 1.6.11-0ubuntu1.3+esm9, 1.8.7-1ubuntu5.15+esm10, 1:1.11.11-1ubuntu1.21+esm13, 2:2.2.12-1ubuntu0.29+esm6, 2:3.2.12-2ubuntu1.24, 3:4.2.11-1ubuntu1.13, 3:4.2.18-1ubuntu1.7, 3:5.2.4-1ubuntu2.2
python-django (Debian package) - addressed in versions 3:3.2.25-0+deb12u1, 3:4.2.27-0+deb13u1
python311-Django - update to 4.2.11-150600.3.44.1
python-django - update to 4.2.15-11
python3-Django - update to 4.2.15-11
python-django-help - update to 4.2.15-11
Oracle Solaris - addressed in versions 11.3 ESU 36.35, 11.4 SRU 89

External References

Related Security Bulletins