CVE-2018-16385: ThinkPHP SQL Injection vulnerability
ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.
Other sources
ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/topthink/frameworkto a version that resolves this vulnerability.Fixed in 5.1.23
Event History
Frequently Asked Questions
What is the vulnerability ID for ThinkPHP before 5.1.23?
The vulnerability ID for ThinkPHP before 5.1.23 is CVE-2018-16385.
What is the severity of CVE-2018-16385?
The severity of CVE-2018-16385 is critical, with a score of 9.8.
How does ThinkPHP before 5.1.23 allow SQL Injection?
ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.
What software versions are affected by CVE-2018-16385?
ThinkPHP versions up to 5.1.23 are affected by CVE-2018-16385.
Where can I find more information about CVE-2018-16385?
More information about CVE-2018-16385 can be found at the following references: [Vulnerability Details](https://exchange.xforce.ibmcloud.com/vulnerabilities/149288), [GitHub Issue](https://github.com/top-think/framework/issues/1375).