Litokollo tse lokisoang tsa moralo oa webo oa Django 4.0.6 le 3.2.14 li phatlalalitsoe, tse lokisang ts'oaetso (CVE-2022-34265) e ka u lumellang ho kenya khoutu ea SQL sebakeng sa hau. Taba ena e ama lits'ebetso tse sebelisang data ea kantle e sa netefatsoang ka mofuta le li-parameter tsa lookup_name tse fetiselitsoeng ho mesebetsi ea Trunc(mofuta) le Extract(lookup_name). Mananeo a lumellang data e netefalitsoeng feela ho lookup_name le boleng bo botle ha a angoe ke ho ba kotsing.
Bothata bo ne bo thibetsoe ka ho thibela tšebeliso ea litlhaku tse ling ntle le litlhaku, linomoro, “-“, “_”, “(” le “)” lipuisanong tsa mesebetsi ea Extract and Trunc. Pejana, qotsulo e le 'ngoe e ne e sa khaotsoe ka boleng bo fetisitsoeng, e leng se entseng hore ho khonehe ho etsa SQL ea hau ka ho fetisa litekanyetso tse kang "letsatsi' HO TLOHA ho qala_datetime)) KAPA 1=1;—" le "year', start_datetime) ) KAPA 1=1;—“. Khatisong e latelang ea 4.1, ho reriloe ho matlafatsa ts'ireletso ea mekhoa ea ho hula le ho fokotsa matsatsi, empa liphetoho tse entsoeng ho API li tla lebisa ho senyeha ha ho lumellana le li-backend tsa basebetsi ba boraro.
Source: opennet.ru