Django Hit By SQL Injection and DoS Vulnerabilities

Recent security releases address two vulnerabilities affecting all supported Django versions, including the upcoming Django 6.0. These vulnerabilities pose significant risks to Django-based applications, potentially leading to SQL injection and denial-of-service (DoS) attacks. It's crucial for developers and security teams to understand and mitigate these risks promptly.

The first vulnerability, CVE-2025-13372, is a high-severity SQL injection flaw affecting deployments using PostgreSQL. This vulnerability lies within the `FilteredRelation` class and how the ORM manages column aliases. An attacker could exploit this by crafting a malicious dictionary in applications that expose parameters ending in `QuerySet.annotate()` or `QuerySet.alias()`. This allows the attacker to inject SQL fragments into Django-generated queries, potentially enabling them to read, modify, or delete data, or gain broader access to the database than intended.

The second vulnerability, CVE-2025-64460, focuses on service availability, leading to a DoS attack. The flaw is within the XML serializer, specifically the `django.core.serializers.xml_serializer.getInnerText()` method. Due to inefficient string concatenation, a specially crafted XML document can cause the server to consume excessive time and resources during processing. This can lead to high CPU and memory usage, ultimately resulting in a denial of service.

Django has released patched versions 5.2.9, 5.1.15, and 4.2.27 to address these vulnerabilities. The Django team strongly advises upgrading to these versions as soon as possible. Furthermore, it is recommended to review logs for anomalous queries or unusual XML usage patterns and reinforce input validation and perimeter controls to minimize exposure.

Fuente Original: https://unaaldia.hispasec.com/2025/12/inyeccion-sql-y-dos-nuevas-vulnerabilidades-sacuden-el-ecosistema-django.html?utm_source=rss&utm_medium=rss&utm_campaign=inyeccion-sql-y-dos-nuevas-vulnerabilidades-sacuden-el-ecosistema-django

Artículos relacionados de LaRebelión:

• Revive Clasicos DOS Multijugador Juega en tu Navegador
• Holiday Planning Gemini AI Tips and Tricks
• ChatGPT Atlas Exploit Hidden Commands and Browser Security
• Dos Zero-Days de Windows Explotados Activamente
• ChatGPTs Grown-Up Mode Gore and Eroticism

Artículo generado mediante LaRebelionBOT