CVE-2021-30459

Advisory

A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form. See CVE-2021-30459.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form. See CVE-2021-30459.


CONFIRM:https://github.com/jazzband/django-debug-toolbar/security/advisories/GHSA-pghf-347x-c2gj: https://github.com/jazzband/django-debug-toolbar/security/advisories/GHSA-pghf-347x-c2gj
CONFIRM:https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/: https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/
MISC:https://github.com/jazzband/django-debug-toolbar/releases: https://github.com/jazzband/django-debug-toolbar/releases

Resources

• https://github.com/jazzband/django-debug-toolbar/security/advisories/GHSA-pghf-347x-c2gj
• https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/
• https://github.com/jazzband/django-debug-toolbar/releases
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30459