A vulnerability in the Django web framework that may lead to SQL code injection.
Corrective releases of the web framework Django 4.0.6 and 3.2.14 have been published, addressing a vulnerability (CVE-2022-34265) that could potentially allow for SQL code injection. The issue affects applications that use unverified external data in the parameters kind and lookup_name passed to the functions Trunc(kind) and Extract(lookup_name). Programs that only allow verified data in lookup_name and kind are not affected by this vulnerability. The issue has been blocked through restrictions […]
