Django PostGIS RasterField Band Index SQL Injection

#!/usr/bin/env python3
"""CVE-2026-1207 version checker — Django PostGIS RasterField SQL Injection.
Outputs: VULNERABLE | PATCHED | UNKNOWN
Exit codes: 1 = vulnerable, 0 = patched, 2 = unknown
"""
import sys
import subprocess
import re

def get_django_version():
    """Try import first, fall back to pip show."""
    try:
        import django
        return django.get_version()
    except ImportError:
        pass
    try:
        out = subprocess.check_output(
            [sys.executable, "-m", "pip", "show", "django"],
            stderr=subprocess.DEVNULL, text=True
        )
        for line in out.splitlines():
            if line.startswith("Version:"):
                return line.split(":", 1)[1].strip()
    except Exception:
        pass
    return None

def ver(s):
    """Parse version string to comparable tuple."""
    parts = re.match(r"(\d+)\.(\d+)\.?(\d+)?", s)
    if not parts:
        return None
    return (int(parts.group(1)), int(parts.group(2)), int(parts.group(3) or 0))

def check(v):
    """Return True if version is vulnerable."""
    # Fixed: 6.0.2, 5.2.11, 4.2.28
    # Vulnerable ranges:
    #   6.0.0 - 6.0.1
    #   5.2.0 - 5.2.10
    #   4.2.0 - 4.2.27
    #   All unsupported series below 4.2 or between supported series
    if v >= (6, 0, 0) and v < (6, 0, 2):
        return True
    if v >= (5, 2, 0) and v < (5, 2, 11):
        return True
    if v >= (4, 2, 0) and v < (4, 2, 28):
        return True
    # Unsupported series: 5.0.x, 5.1.x assumed vuln (no patch)
    if v >= (5, 0, 0) and v < (5, 2, 0):
        return True
    # 4.0.x, 4.1.x — unsupported, assumed vuln
    if v >= (4, 0, 0) and v < (4, 2, 0):
        return True
    # 3.x and below — unsupported, assumed vuln (unless HeroDevs 3.2.27+)
    if v < (4, 0, 0):
        # HeroDevs patched 3.2.27; check for that
        if v >= (3, 2, 27):
            return False  # HeroDevs NES patch
        return True
    return False

def main():
    version_str = get_django_version()
    if version_str is None:
        print("UNKNOWN - Django not found in this Python environment")
        sys.exit(2)

    v = ver(version_str)
    if v is None:
        print(f"UNKNOWN - Could not parse Django version: {version_str}")
        sys.exit(2)

    if check(v):
        print(f"VULNERABLE - Django {version_str} is affected by CVE-2026-1207")
        print("  Fix: upgrade to 6.0.2, 5.2.11, or 4.2.28+")
        # Additional context: check if PostGIS is even in use
        try:
            from django.conf import settings
            if hasattr(settings, 'DATABASES'):
                for alias, db in settings.DATABASES.items():
                    if 'postgis' in db.get('ENGINE', '').lower():
                        print(f"  WARNING: database '{alias}' uses PostGIS — exploitation is possible")
        except Exception:
            print("  Note: could not inspect DATABASES setting (run within Django context for full check)")
        sys.exit(1)
    else:
        print(f"PATCHED - Django {version_str} is not affected by CVE-2026-1207")
        sys.exit(0)

if __name__ == "__main__":
    main()