GHSA-78q9-24gv-g288CriticalCVSS 9.8

ThinkPHP SQLi Vulnerability

Published
May 14, 2022
Last Modified
July 25, 2023

🔗 CVE IDs covered (1)

CVE-2018-18529 →

📋 Description

ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI.

🎯 Affected products1

  • composer/topthink/framework:<= 3.2.4

🔗 References (3)