CVE-2018-17566: SQL Injection
Published Sep 26, 2018
·Updated
In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request.
Affected Software
2 affected components
composer/topthink/framework=5.1.24
ThinkPHP ThinkPHP=5.1.24
Event History
Sep 26, 2018
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
May 14, 2022
Advisory Published
via GitHub·01:57 AM
Frequently Asked Questions
1
What is the vulnerability ID of this ThinkPHP vulnerability?
The vulnerability ID of this ThinkPHP vulnerability is CVE-2018-17566.
2
What is the severity of CVE-2018-17566?
The severity of CVE-2018-17566 is critical with a severity value of 9.8.
3
How does this ThinkPHP vulnerability affect the software?
In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request.
4
How can the SQL injection vulnerability be exploited?
The SQL injection vulnerability in ThinkPHP 5.1.24 can be exploited by controlling the value of the WHERE condition in the delete function.
5
Is there a fix available for CVE-2018-17566?
Yes, a fix is available for CVE-2018-17566. It is recommended to update to a version of ThinkPHP that is not affected by this vulnerability.