id: PYSEC-2021-10
details: A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before
  1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements
  by changing the raw_sql input field of the SQL explain, analyze, or select form.
affected:
- package:
    name: django-debug-toolbar
    ecosystem: PyPI
    purl: pkg:pypi/django-debug-toolbar
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 0.10.0
    - fixed: 1.11.1
    - introduced: "2.0"
    - fixed: 2.2.1
    - introduced: "3.0"
    - fixed: 3.2.1
  versions:
  - 0.10.0
  - 0.10.1
  - 0.10.2
  - "0.11"
  - 0.11.0
  - "1.0"
  - 1.0.1
  - "1.1"
  - "1.2"
  - 1.2.1
  - 1.2.2
  - 1.3.0
  - 1.3.1
  - 1.3.2
  - "1.4"
  - "1.5"
  - "1.6"
  - "1.7"
  - "1.8"
  - "1.9"
  - 1.9.1
  - "1.10"
  - 1.10.1
  - "1.11"
  - "2.0"
  - "2.1"
  - "2.2"
  - "3.0"
  - "3.1"
  - 3.1.1
  - 3.2a1
  - "3.2"
references:
- type: ADVISORY
  url: https://github.com/jazzband/django-debug-toolbar/security/advisories/GHSA-pghf-347x-c2gj
- type: ARTICLE
  url: https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/
- type: WEB
  url: https://github.com/jazzband/django-debug-toolbar/releases
aliases:
- CVE-2021-30459
- GHSA-pghf-347x-c2gj
modified: "2021-04-21T15:05:00Z"
published: "2021-04-14T18:15:00Z"