DjangoBlog vulnerabilities

A vulnerability was found in liangliangyy DjangoBlog up to version 2.1.0.0 involving a hard-coded cryptographic key in djangoblog/settings.py within the File Upload Endpoint component. Manipulating the SECRET_KEY argument results in use of a hard-coded key. Remote exploitation is possible but rated as high complexity and difficult exploitability.

A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0 in an unknown function of the djangoblog/settings.py file, related to settings handling. Manipulation of the USER/PASSWORD arguments leads to hard-coded credentials. The attack can be launched remotely but requires a high level of complexity. The exploit has been publicly disclosed, and the vendor did not respond.

A flaw was found in liangliangyy DjangoBlog up to 2.1.0.0 affecting the form_valid function in oauth/views.py. Manipulating the oauthid argument causes improper authorization, and the attack may be initiated remotely. The exploit has been published.

A weakness was identified in liangliangyy DjangoBlog up to 2.1.0.0 affecting an unknown function in blog/views.py of the Clean Endpoint component, causing missing authentication. The attack may be initiated remotely, and a public exploit could be used. The vendor was contacted but did not respond.

A security flaw was discovered in DjangoBlog up to version 2.1.0.0 affecting djangoblog/settings.py, where a hard-coded SECRET_KEY is used. The attack can be launched remotely but requires high complexity. The exploit has been publicly released and the vendor did not respond.

A vulnerability was determined in liangliangyy DjangoBlog up to 2.1.0.0 in the CommandHandler function of servermanager/api/commonapi.py within the WeChat Bot Interface component. Manipulation of the Source argument leads to command injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized; the vendor was contacted but did not respond.