CVE-2022-34265 Scanner

Django is a high-level Python web framework used by developers to build secure, scalable web applications quickly. It is popular among startups, enterprises, and individual developers for its built-in admin panel, ORM, and security features. Django powers many content management systems, e-commerce platforms, and data-driven websites across various industries.

CVE-2022-34265 is a critical SQL injection vulnerability in Django versions 3.2 and 4.0. It arises because the Trunc() and Extract() database functions do not properly sanitize user-supplied datetime parameters before constructing SQL queries. This flaw allows an attacker to break out of the intended query structure and execute arbitrary SQL commands.

The vulnerability specifically affects the Trunc() and Extract() functions when used with untrusted input for the 'kind' parameter. For example, if an application passes user-controlled data directly to these functions without validation, an attacker can inject SQL statements that modify the query logic. This can be exploited through any endpoint that uses these functions with external input.

If exploited, an attacker can read, modify, or delete sensitive data from the database, potentially gaining full control over the application. This could lead to data breaches, privilege escalation, or complete system compromise. Given the CVSS score of 9.8, immediate action is required to mitigate this critical risk.