1-day

Do not use `maildev` anyway 💣

Do not use `maildev` anyway 💣

Introduce Do you guys know maildev application to run temporary mail server? maildev is open-sourced SMTP Server + Web Interface for viewing and testing emails during development. To say conclusionally, DO NOT USE THIS SOFTWARE. Hackers can force-write existing source codes and completely takeover the server. This program has not been

CVE-2023-36053: Potential ReDoS in EmailValidator/URLValidator

CVE-2023-36053: Potential ReDoS in EmailValidator/URLValidator

Hi! This is Seokchan Yoon studying Offensive Security in Korea. 🇰🇷 __ 1. Introduction On July 3rd, 2023, my first CVE was published! * https://www.djangoproject.com/weblog/2023/jul/03/security-releases/ * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36053 You can briefly check the details of the vulnerability that I

CVE-2023-23969: Potential denial-of-service via Accept-Language headers

CVE-2023-23969: Potential denial-of-service via Accept-Language headers

Overview Hi guys, this is Seokchan Yoon. The Django security vulnerability has released on February 1, 2023. Because I have big interest in Django, so I analyze this issue just in time. To see the detail for this issue, click the link below. Django security releases issued: 4.1.6,

CVE-2022-28347: Potential SQLi via QuerySet.explain() on PostgreSQL

CVE-2022-28347: Potential SQLi via QuerySet.explain() on PostgreSQL

CVE-2022-28347, Potential SQL injection in Django QuerySet explain() Analysis > https://github.com/advisories/GHSA-w24h-v9qh-8gxj 이 취약점은 PostgreSQL 환경에서 Django QuerySet의 explain 기능을 수행할 때 발생 가능한 SQL Injection 취약점이다. QuerySet 오브젝트의 explain() 메소드를 수행하면 EXPLAIN 명령어를 사용할 수 있다. 이 명령어를 사용할 때 MySQL과 PostgreSQL에서는 특별히 EXPLAIN 명령어에 옵션을

CVE-2022-34265: Potential SQLi via Trunc() and Extract()

CVE-2022-34265: Potential SQLi via Trunc() and Extract()

개요 CVE-2022-34265: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments 최근 우리 회사 슬랙 방에서 평소 존경하던 갓해커 분이 올려주신 Django SQL Injection CVE가 하나 있어서 분석해보았다. 아무래도 Django를 통해 사내 프로젝트, 학교 프로젝트를 몇 번씩 진행해본 경험이 있다보니 자칭 Django 전문가로서 CVE를 분석해보지 않고 지나칠 수가