joshualent/django-cve-2025-64459demo application showing off SQL Injection exploit in django 5.2.7
This application demonstrates CVE-2025-64459 affecting multiple Django versions. This vulnerability has been patched in newer releases of Django.
SQL Injection is when user-provided input is treated as part of a SQL query, allowing an attacker to change how the query works and expose or modify data they should not be able to access.
This is a SQL Injection vulnerability in Django QuerySets and Q objects that can result in data exposure. The exploit is a result of passing query parameters to a Django QuerySet, where the user is able to set the _connector and _negated keys to execute arbitrary SQL fragments.
In this app, the exploit is done on the home URL route. Visiting cve.hyperf.app/?_connector=OR 1=1 OR inserts OR 1=1 OR into the SQL query, which means that the filter will match every record, and all results will be returned. In this case, posts that are archived or set to DRAFT status are exposed.
[!NOTE]
db.sqlite3 and .env are intentionally tracked by git to setup the database for the exploit.
clone the repo and sync dependencies with uv.
uv sync
Start the dev server.
uv run manage.py runserver
