CVE-2020-7471

CVE-2020-7471

This repository provides the environment and POC for CVE-2020-7471 Potential SQL injection via StringAgg(delimiter) vulnerability.

Affected Django versions

• 1.11 to 1.11.28 (exclusive)
• 2.2 to 2.2.10 (exclusive)
• 3.0 to 3.0.3 (exclusive)

The following steps are required before downloading and using:

1. Install a vulnerable version of Django. The version I used for testing is:

   root@kitploit:~

   pip install django==3.0.2 -i https://pypi.tuna.tsinghua.edu.cn/simple
   

2. Refer to https://www.runoob.com/postgresql/windows-install-postgresql.html to complete the installation of the PostgreSQL database.

3. Create a new database

   root@kitploit:~

   CREATE DATABASE test;
   

4. Modify the database configuration in sqlvul_projects/settings.py. If you used the default configuration (including setting the password to 'postgres') during installation in the previous step, you do not need to modify any configuration and can skip this step.

   root@kitploit:~

   DATABASES = {
       'default': {
           'ENGINE': 'django.db.backends.postgresql',
           'NAME': 'test',         # 数据库名称
           'USER': 'postgres',
           'PASSWORD': 'postgres', # 数据库用户密码
           'HOST': '127.0.0.1',    # 数据库地址
           'PORT': '5432',
       }
   }
   

5. Initialize the database tables via Django

   root@kitploit:~

   python3 manage.py migrate
   python3 manage.py makemigrations test_app
   python3 manage.py migrate test_app
   

Then run the POC script poc.py.

Reference https://github.com/Saferman/CVE-2020-7471