PT-2018-14496 · Thinkphp · Thinkphp

Kingkk · Published 2018-10-19 · Updated 2022-05-14 · CVE-2018-18529

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThinkPHP version 3.2.4

Description The issue is related to SQL Injection via the count parameter. This occurs because the parseKey function in the Library/Think/Db/Driver/Mysql.class.php file mishandles the key variable. It is noted that a backquote character is not required in the attack URI.

Recommendations For ThinkPHP version 3.2.4, consider restricting access to the count parameter to minimize the risk of SQL Injection until a patch is available. As a temporary workaround, avoid using the parseKey function in the Library/Think/Db/Driver/Mysql.class.php file until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-18529

GHSA-78Q9-24GV-G288

Affected Products

Thinkphp

References · 5

• 🔥 https://kingkk.com/2018/10/Thinkphp-%E8%81%9A%E5%90%88%E6%9F%A5%E8%AF%A2%E6%BC%8F%E6%B4%9E/#ThinkPHP3-lt-3-2-4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18529 · Security Note
• https://osv.dev/vulnerability/CVE-2018-18529 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-78q9-24gv-g288 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18529 · Note