Django QuerySet.order_by - SQL Injection
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 contain a SQL injection caused by untrusted input in QuerySet.order_by, letting attackers execute arbitrary SQL commands, exploit requires attacker to control order_by input. References: https://nvd.nist.gov/vuln/detail/CVE-2021-35042 https://github.com/zer0qs/CVE-2021-35042 https://github.com/django/django/commit/a34a5f724c5d5adb2109374ba3989ebb7b11f81f Remediation: Update to Django 3.1.13 or 3.2.5 or later versions.
9 assets checked · domain, subdomain, ipv4