CVE-2021-35042

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.

CVSS v4.0 GitHub

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

44.37% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-89

Published

2021-07-02

Updated

2024-08-04

Proof-of-concept exploits (9)

• LUUANHDUC/CVE-2021-350420★ · 2023-05-18
• WynSon/CVE-2021-350422★ · 2022-04-29
• YouGina/CVE-2021-3504213★ · 2021-07-10
• Zh0ngS0n1337/CVE-2021-350422★ · 2022-04-29
• mrlihd/CVE-2021-350420★ · 2021-09-18
• n3utr1n00/CVE-2021-350422★ · 2022-04-29
• r4vi/CVE-2021-350425★ · 2022-02-10
• zer0qs/CVE-2021-350422★ · 2022-04-29
• vutiendat323/INT14107_CVE-2021-350420★ · 2026-04-18

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/dast/cves/2021/CVE-2021-35042.yaml

Vulhub environments (1)

• vulhub/vulhub/tree/master/django/CVE-2021-35042

Security advisories

• https://docs.djangoproject.com/en/3.2/releases/security
• https://www.djangoproject.com/weblog/2021/jul/01/security-releases
• https://security.netapp.com/advisory/ntap-20210805-0008
• https://www.openwall.com/lists/oss-security/2021/07/02/2
• advisories/GHSA-xpfp-f569-q3p2

References

• CVE Record
• NVD entry

Related

• CVE-2022-28346
• CVE-2023-32243
• CVE-2021-41773
• CVE-2020-7471
• CVE-2024-57521
• CVE-2021-44228