An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged `POST` data in `GenericInlineModelAdmin`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank N05ec@LZU-DSLab for reporting this issue.
The vulnerability (CWE-862 — Missing Authorization) affects the GenericInlineModelAdmin component in the Django admin panel. When submitting a form containing crafted POST data, permissions to add objects for related inline models were not verified on the server side. An attacker can construct an appropriate POST request and submit it directly, bypassing the standard interface path, resulting in unauthorized addition of records to the database.
An attacker without required permissions can unauthorized create or modify objects of inline models in the Django admin panel, leading to violation of data integrity and confidentiality as well as compromise of application business logic.
Django should be updated to version 6.0.4, 5.2.13 or 4.2.30 (depending on the branch in use). For unsupported versions (5.0.x, 4.1.x, 3.2.x), urgent migration to a supported branch and application of the appropriate patch is recommended.
Django in versions: 6.0 before 6.0.4, 5.2 before 5.2.13 and 4.2 before 4.2.30. Older, unsupported branches (5.0.x, 4.1.x, 3.2.x) were not evaluated and may also be vulnerable.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HDjangoproject Django
APPDjangoproject4.2 – 4.2.30 (excl.)5.2 – 5.2.13 (excl.)6.0 – 6.0.4 (excl.)
Related vulnerabilities
SQL injection w Django via argument _connector w QuerySet i Q()
SQL Injection w Django przez HasKey lookup na bazie Oracle
Pominięcie walidacji przy wielokrotnym przesyłaniu plików w Django
SQL injection w funkcjach Trunc() i Extract() frameworka Django
SQL injection w metodach QuerySet Django przez aliasy kolumn