PT-2021-24084 · Thinkphp5 · Thinkphp5

Cyber-Word · Published 2021-12-15 · Updated 2021-12-20 · CVE-2021-44350

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ThinkPHP5 versions 5.0.x through 5.1.22

Description: A SQL Injection issue exists via the parseOrder function in Builder.php.

Recommendations: For versions 5.0.x through 5.1.22, consider updating to a version that contains a fix for this issue, as using the parseOrder function in Builder.php may pose a risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-44350

GHSA-Q868-C4VW-QJX3

Affected Products

Thinkphp5

References · 5

• 🔥 https://github.com/top-think/framework/issues/2613 · Exploit
• https://osv.dev/vulnerability/CVE-2021-44350 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44350 · Security Note
• https://osv.dev/vulnerability/GHSA-q868-c4vw-qjx3 · Vendor Advisory
• https://github.com/top-think/framework · Note