Django Software Foundation releases a patch for a high-severity SQL injection vulnerability. Django’s main branch and three other versions – 3.2, 4.0 and 4.1 – are affected by the vulnerability. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. The vulnerability allows a threat actor to attack Django-based web applications through a command for deleting data known as Trunc and a command known as Extract.”]
Source: https://www.fraudtoday.io/django-software-foundation-patches-high-severity-bug-a-19505