{"uuid": "892399a8-c9f4-4f2f-a5f9-7a3e5152801c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34265", "type": "seen", "source": "https://t.me/hacking_Attack/60138", "content": "Black Hat Ethical Hacking\nDjango fixes SQL Injection vulnerability in new releases\n\nDjango fixes SQL Injection vulnerability in new releasesPost Views: 6 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nThe Django\u00a0project, an\u00a0open source Python-based web framework has patched a high severity vulnerability(SQLi) in its latest releases.\nTracked as\u00a0CVE-2022-34265, the potential SQL Injection vulnerability exists in\u00a0Django\u2019s main branch, and versions\u00a04.1 (currently in beta),\u00a04.0, and\u00a03.2.\u00a0New releases and patches\u00a0issued today\u00a0squash the vulnerability.\n\nTens of thousands of websites, including some popular brands\u00a0in the U.S. alone choose\u00a0Django as their\u00a0Model-Template-View\u00a0framework, according to some estimates. This is why the need to upgrade or patch your Django instances against bugs like these is crucial. New releases mitigate potential SQL Injection Today,\u00a0the Django team has released versions Django 4.0.6\u00a0and Django 3.2.14\u00a0that address a high-severity SQL injection vulnerability and is urging\u00a0developers to upgrade or patch their Django instances as soon as possible.\n\nAssigned\u00a0CVE-2022-34265, the vulnerability can allow a threat actor\u00a0to attack Django web applications via\u00a0arguments provided to the Trunc(kind) and Extract(lookup_name) functions.\n\n\u201cTrunc() and Extract() database functions were subject to SQL injection if untrusted data was used as a kind/lookup_name value,\u201d states\u00a0the advisory.\n\n\u201cApplications that constrain the lookup name\u00a0and kind\u00a0choice to a known safe list are unaffected.\u201d\n\nIn other words, your application is not vulnerable if it is performing some kind of input sanitization or escaping before passing these arguments to the Trunc and Extract\u00a0functions. \n\nResearcher\u00a0Takuto Yoshikai\u00a0of Aeye Security Lab has been credited with responsibly reporting the vulnerability.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Patches also availableFor those unable to upgrade to fixed Django versions\u00a04.0.6 or\u00a03.2.14, the team has made patches available that can be applied to existing affected versions.\n\nPatches to resolve the issue have been applied to Django\u2019s main branch and to the 4.1, 4.0, and 3.2 release branches. The patches may be obtained from the following changesets:\n\n \n* On the main branch\n* On the 4.1 release branch\n* On the 4.0 release branch\n* On the 3.2 release branch\n\u201cThis security release mitigates the issue, but we have identified improvements to the Database API methods related to date extract and truncate that would be beneficial to add to Django 4.1 before [its] final release,\u201d\u00a0further states Django team.\nTrending: CISA warns of hackers exploiting PwnKit Linux vulnerability Trending: Offensive Security Tool: Axiom \u201cThis will impact 3rd party database backends using Django 4.1 release candidate 1 or newer, until they are able to update to the API changes. We apologize for the inconvenience.\u201d\n\nDjango\u2019s security policy\u00a0states\u00a0that any potential security issues be reported privately via email to security@djangoproject.com, as opposed to using Django\u2019s Trac instance or public mailing lists.\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nTrending: How do QR Codes work and how criminal hackers use them to generate phishing attacks \u2013 Demo Source: bleepingcom[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:44.964943Z"}