Reproduce CVE-2020-7471# CVE-2020-7471
SQL injection via StringAgg delimeter input
# Setup:
Run `./setup.sh` for initial setup
Open the docker image to initiate the database:
`docker exec -it {container_id} /bin/bash`
And run the following commands:
```
python manage.py makemigrations vul_app
python manage.py migrate
```
Start the instances using:
`docker-compose up`
Now open the following URL to load sample data:
http://localhost:8000/vul_app/setupdb
Then go to the vulnerable page at:
http://localhost:8000/vul_app/
Exploit the parameter at:
http://localhost:8000/vul_app/?delim=!@#
[4.0K] /data/pocs/8e72261b874f284d48257fbcb53a3e4e90b2c658
├── [4.0K] cve20207471
│ ├── [ 415] asgi.py
│ ├── [3.6K] settings.py
│ ├── [ 860] urls.py
│ └── [ 415] wsgi.py
├── [ 387] docker-compose.yml
├── [ 159] Dockerfile
├── [ 574] README.md
├── [ 37] requirements.txt
├── [ 181] setup.sh
└── [4.0K] vul_app
├── [ 66] admin.py
├── [ 151] apps.py
├── [ 259] models.py
├── [4.0K] templates
│ └── [ 829] index.html
├── [ 63] tests.py
├── [ 179] urls.py
└── [1.0K] views.py
3 directories, 16 files