PT-2018-14057 · Thinkphp · Thinkphp

Ghost · Publicado 2018-09-26 · Atualizado 2022-05-14 · CVE-2018-17566

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThinkPHP version 5.1.24

Description The issue allows for SQL injection when the delete function's WHERE condition value can be controlled by a user's request. This can potentially lead to unauthorized data access or modification.

Recommendations For ThinkPHP version 5.1.24, consider validating and sanitizing user input to prevent manipulation of the WHERE condition value in the delete function until a patch is available. Restrict access to sensitive data and ensure proper input handling to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-17566

GHSA-75FM-52MM-Q5RM

Produtos afetados

Thinkphp

Referências · 6

• 🔥 https://github.com/top-think/think/issues/858 · Exploit
• https://github.com/top-think/framework · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17566 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-17566 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-17566 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-75fm-52mm-q5rm · Aviso do Fabricante