CVEs-PoC/2019/CVE-2019-7164.md

CVE-2019-7164

Description

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.

POC

Reference

• https://github.com/sqlalchemy/sqlalchemy/issues/4481
• https://www.oracle.com/security-alerts/cpujan2021.html

Github

• https://github.com/18F/10x-dux-vuls-eval
• https://github.com/18farchive/10x-dux-vuls-eval
• https://github.com/qquang/CTFs