Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2020-7471 PoC — Django SQL注入漏洞

Source
https://github.com/victomteng1997/cve-2020-7471-Time_Blind_SQLi-
Associated Vulnerability
Title:Django SQL注入漏洞 (CVE-2020-7471)
Description:Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.
File Snapshot

 [4.0K]  /data/pocs/144823ba25d928159d00c19a3475dcb295ad1caa
├── [4.0K]  CVE-2020-7471
│   ├── [3.9K]  CVE-2020-7471.py
│   ├── [ 634]  manage.py
│   ├── [4.0K]  sqlvul_project
│   │   ├── [ 405]  asgi.py
│   │   ├── [   0]  __init__.py
│   │   ├── [4.0K]  __pycache__
│   │   │   ├── [ 174]  __init__.cpython-36.pyc
│   │   │   ├── [2.3K]  settings.cpython-36.pyc
│   │   │   ├── [1000]  urls.cpython-36.pyc
│   │   │   └── [ 560]  wsgi.cpython-36.pyc
│   │   ├── [3.2K]  settings.py
│   │   ├── [ 789]  urls.py
│   │   └── [ 405]  wsgi.py
│   └── [4.0K]  vul_app
│       ├── [  63]  admin.py
│       ├── [  88]  apps.py
│       ├── [   0]  __init__.py
│       ├── [4.0K]  migrations
│       │   ├── [ 518]  0001_initial.py
│       │   ├── [ 547]  0002_credential.py
│       │   ├── [   0]  __init__.py
│       │   └── [4.0K]  __pycache__
│       │       ├── [ 654]  0001_initial.cpython-36.pyc
│       │       ├── [ 692]  0002_credential.cpython-36.pyc
│       │       └── [ 178]  __init__.cpython-36.pyc
│       ├── [ 247]  models.py
│       ├── [4.0K]  __pycache__
│       │   ├── [ 208]  admin.cpython-36.pyc
│       │   ├── [ 167]  __init__.cpython-36.pyc
│       │   └── [ 595]  models.cpython-36.pyc
│       ├── [  60]  tests.py
│       └── [  63]  views.py
├── [ 56K]  result_sample.png
└── [1.5K]  setup.txt

7 directories, 28 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →