SQL Injection in Django
Critical severity
GitHub Reviewed
Published
Apr 13, 2022
to the GitHub Advisory Database
•
Updated Sep 5, 2023
Package
Affected versions
>= 2.2, < 2.2.28
>= 3.2, < 3.2.13
>= 4.0, < 4.0.4
Patched versions
2.2.28
3.2.13
4.0.4
Description
Published by the National Vulnerability Database
Apr 12, 2022
Published to the GitHub Advisory Database
Apr 13, 2022
Reviewed
Apr 22, 2022
Last updated
Sep 5, 2023
A SQL injection issue was discovered in
QuerySet.explain()in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the**optionsargument, and placing the injection payload in an option name.References