CVE-2026-1207 — Django 框架在使用 PostGIS 查询地理栅格（raster）数据时，若将未经验证的用户输入直接作为 band index（波段索引）参数，会引发 SQL 注入 | Kitploit

Vulnerability Overview

Vulnerability Type: SQL Injection Affected Component: django.contrib.gis RasterField

When querying with Django GIS's RasterField, the band parameter is directly concatenated into the SQL statement, leading to a SQL injection vulnerability. Attackers can inject arbitrary SQL code by crafting a malicious band parameter value.

Project Structure

CVE-2026-1207/
├── .devcontainer/     # VSCode DevContainer configuration
├── .vscode/           # VSCode configuration
├── vuln/             # Vulnerability demonstration application
│   ├── models.py     # Model containing RasterField
│   ├── views.py      # Vulnerability trigger point
│   └── migrations/   # Database migration files
├── web/              # Django project configuration
├── manage.py
├── README.md

def get(self, request: HttpRequest):
    band = request.GET.get("band", 1)  # ← Unfiltered user input
    rast = GDALRaster(...)
    qs = RasterModel.objects.filter(rast__contains=(rast, band))  # ← band is passed directly into the query
    print(qs.query)  # ← View the generated SQL
    qs.count()
    return HttpResponse("book app")

CVE-2026-1207

Most Popular

Environment Setup

1️⃣ Open the Project

2️⃣ Reopen in Container (Build Dev Container)

3️⃣ Run the Django Development Server

4️⃣ Open a Browser and Access the Project

5️⃣ Notes

Vulnerability Reproduction

POC: Time-based Injection

Vulnerable Code Location

Generated SQL (After Injection)

Disclaimer