PT-2021-18736 · Django · Django Debug Toolbar

Jezdez

·

CVE-2021-30459

·

Published

2021-04-14

·

Updated

2026-07-14

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Django Debug Toolbar versions 1.x through 1.11.0 Django Debug Toolbar versions 2.x through 2.2.0 Django Debug Toolbar versions 3.x through 3.2.0
Description A SQL Injection issue in the SQL Panel allows attackers to execute SQL statements by changing the raw sql input field of the SQL explain, analyze, or select form. This is a high severity issue for anyone using the toolbar in a production environment.
Recommendations For Django Debug Toolbar version 1.x, upgrade to version 1.11.1. For Django Debug Toolbar version 2.x, upgrade to version 2.2.1. For Django Debug Toolbar version 3.x, upgrade to version 3.2.1.

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-30459
GHSA-PGHF-347X-C2GJ
OPENSUSE-SU-2024:11225-1
OPENSUSE-SU-2024:14137-1
OPENSUSE-SU-2026:11271-1
PYSEC-2021-10

Affected Products

Django Debug Toolbar