PT-2018-14496 · Thinkphp · Thinkphp

Kingkk · Publicado 2018-10-19 · Atualizado 2022-05-14 · CVE-2018-18529

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThinkPHP version 3.2.4

Description The issue is related to SQL Injection via the count parameter. This occurs because the parseKey function in the Library/Think/Db/Driver/Mysql.class.php file mishandles the key variable. It is noted that a backquote character is not required in the attack URI.

Recommendations For ThinkPHP version 3.2.4, consider restricting access to the count parameter to minimize the risk of SQL Injection until a patch is available. As a temporary workaround, avoid using the parseKey function in the Library/Think/Db/Driver/Mysql.class.php file until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-18529

GHSA-78Q9-24GV-G288

Produtos afetados

Thinkphp

Referências · 5

• 🔥 https://kingkk.com/2018/10/Thinkphp-%E8%81%9A%E5%90%88%E6%9F%A5%E8%AF%A2%E6%BC%8F%E6%B4%9E/#ThinkPHP3-lt-3-2-4 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18529 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-18529 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-18529 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-78q9-24gv-g288 · Aviso do Fabricante