PT-2018-14057 · Thinkphp · Thinkphp

Ghost · Published 2018-09-26 · Updated 2022-05-14 · CVE-2018-17566

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThinkPHP version 5.1.24

Description The issue allows for SQL injection when the delete function's WHERE condition value can be controlled by a user's request. This can potentially lead to unauthorized data access or modification.

Recommendations For ThinkPHP version 5.1.24, consider validating and sanitizing user input to prevent manipulation of the WHERE condition value in the delete function until a patch is available. Restrict access to sensitive data and ensure proper input handling to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-17566

GHSA-75FM-52MM-Q5RM

Affected Products

Thinkphp

References · 6

• 🔥 https://github.com/top-think/think/issues/858 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17566 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17566 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-75fm-52mm-q5rm · Vendor Advisory
• https://github.com/top-think/framework · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17566 · Note