PT-2021-10431 · Thinkphp · Thinkphp

Feizi76 · Published 2021-09-28 · Updated 2021-10-06 · CVE-2020-20120

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ThinkPHP versions 3.2.3 and below

Description: The issue is a SQL injection vulnerability. It occurs when the array is not passed to the where and query methods.

Recommendations: For ThinkPHP versions 3.2.3 and below, update to a version above 3.2.3 to resolve the issue. As a temporary workaround, consider passing arrays to the where and query methods to prevent SQL injection. Restrict access to these methods to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-20120

GHSA-M7H5-FJJQ-559F

Affected Products

Thinkphp

References · 6

• 🔥 https://github.com/top-think/thinkphp/issues/553 · Exploit
• https://osv.dev/vulnerability/GHSA-m7h5-fjjq-559f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-20120 · Security Note
• https://osv.dev/vulnerability/CVE-2020-20120 · Vendor Advisory
• https://github.com/top-think/thinkphp · Note
• https://t.me/cibsecurity/29613 · Telegram Post