This vulnerability in Django involves improper neutralization of special elements used in SQL commands (CWE-89). Specifically, .QuerySet.order_by() is vulnerable to SQL injection when column aliases containing periods are used in conjunction with FilteredRelation and dictionary expansion. The affected versions are 6.0 prior to 6.0.2, 5.2 prior to 5.2.11, and 4.2 prior to 4.2.28. Unsupported earlier series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated but may also be vulnerable. Red Hat advisories provide patches and updates for affected distributions.

Successful exploitation could allow an attacker with limited privileges (PR:L) to inject SQL commands via crafted column aliases, potentially leading to partial confidentiality and integrity impacts (C:L, I:L) without affecting availability. This could result in unauthorized data access or modification within the database used by Django applications.

Fixes are available in Django versions 6.0.2, 5.2.11, and 4.2.28. Users should upgrade to these or later versions to remediate the vulnerability. Red Hat has released security advisories and updated packages addressing this issue. Applying these official patches is the recommended mitigation. Patch status is confirmed by vendor advisories linked in the references.