CVE-2025-64459
📋 TL;DR
This SQL injection vulnerability in Django allows attackers to execute arbitrary SQL commands by passing specially crafted dictionary arguments to QuerySet.filter(), QuerySet.exclude(), QuerySet.get(), or Q() methods. It affects Django versions 5.1 before 5.1.14, 4.2 before 4.2.26, 5.2 before 5.2.8, and potentially earlier unsupported series. Any Django application using these query methods with dictionary expansion is vulnerable.
💻 Affected Systems
- Django
📦 What is this software?
Django by Djangoproject
Django by Djangoproject
Django by Djangoproject
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution via database functions.
Likely Case
Data exfiltration, data corruption, authentication bypass, and unauthorized access to sensitive information.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database user privilege restrictions.
🎯 Exploit Status
Technical details and proof-of-concept available in public disclosure. Exploitation requires attacker to control dictionary input to vulnerable methods.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Django 5.1.14, 4.2.26, 5.2.8
Vendor Advisory: https://www.djangoproject.com/weblog/2025/nov/05/security-releases/
Restart Required: Yes
Instructions:
1. Backup your Django project and database. 2. Update Django using pip: 'pip install Django==5.1.14' (or appropriate version). 3. Test your application thoroughly. 4. Restart your web server/application.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for all dictionary parameters passed to QuerySet methods
Database User Privilege Reduction
allLimit database user permissions to minimum required operations
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) with SQL injection rules
- Deploy database activity monitoring and alerting for suspicious queries
🔍 How to Verify
Check if Vulnerable:
Check Django version: 'python -m django --version'. If version is 5.1.x < 5.1.14, 4.2.x < 4.2.26, or 5.2.x < 5.2.8, you are vulnerable.Check Version:
python -m django --versionVerify Fix Applied:
After patching, verify version shows patched version and test vulnerable query patterns with safe test inputs.📡 Detection & Monitoring
Log Indicators:
- Unusual database query patterns
- SQL syntax errors in application logs
- Multiple failed query attempts
Network Indicators:
- Unusual database connection patterns
- Large data transfers from database
SIEM Query:
source="django.logs" AND ("SQL" OR "database" OR "query") AND ("error" OR "exception" OR "malformed")