This issue involves a classic SQL injection vulnerability (CWE-89) that is triggered when performing raster lookups on Django's RasterField using PostGIS. The band index parameter is not properly sanitized, allowing an attacker to inject arbitrary SQL statements via the query path. If exploited, the attacker could read, modify, or delete database data, potentially compromising information confidentiality and integrity.

The Django web framework is affected. The vulnerability applies to releases before 6.0.2 in the 6.0 series, before 5.2.11 in the 5.2 series, and before 4.2.28 in the 4.2 series; unsupported older series such as 5.0.x, 4.1.x, and 3.2.x were not formally evaluated but may share the same code and require patching.

The CVSS score of 5.4 indicates a medium severity, and the EPSS score of 4% suggests a modest likelihood of exploitation. The attack vector is remote and requires the ability to send crafted requests to Django applications that use PostGIS raster lookups. Because the vulnerability is not listed in the CISA KEV catalog, there is no evidence of widespread exploitation yet, but the potential impact justifies swift action.