CVE-2018-17566: ThinkPHP SQL injection vulnerability
Published Sep 26, 2018
·Updated
In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request.
Affected Software
3 affected components
composer/topthink/framework=5.1.24
ThinkPHP ThinkPHP=5.1.24
composer/topthink/framework=5.1.24
Event History
Sep 26, 2018
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Data Sourced
via NVD·09:29 PM
DescriptionSeverityWeaknessAffected Software
May 14, 2022
Advisory Published
via GitHub·01:57 AM
Data Sourced
via GitHub·01:57 AM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via Packagist·01:57 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this ThinkPHP vulnerability?
The vulnerability ID of this ThinkPHP vulnerability is CVE-2018-17566.
2
What is the severity of CVE-2018-17566?
The severity of CVE-2018-17566 is critical with a severity value of 9.8.
3
How does this ThinkPHP vulnerability affect the software?
In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request.
4
How can the SQL injection vulnerability be exploited?
The SQL injection vulnerability in ThinkPHP 5.1.24 can be exploited by controlling the value of the WHERE condition in the delete function.
5
Is there a fix available for CVE-2018-17566?
Yes, a fix is available for CVE-2018-17566. It is recommended to update to a version of ThinkPHP that is not affected by this vulnerability.