CVE-2018-18546: SQL Injection

Q: What is CVE-2018-18546?

CVE-2018-18546 is a SQL Injection vulnerability in ThinkPHP 3.2.4.

Q: How severe is CVE-2018-18546?

CVE-2018-18546 has a severity rating of 9.8 (critical).

Q: What is the affected software version of CVE-2018-18546?

CVE-2018-18546 affects ThinkPHP 3.2.4.

Q: How does CVE-2018-18546 occur?

CVE-2018-18546 occurs due to SQL Injection via the order parameter in ThinkPHP 3.2.4.

Q: Are there any references for CVE-2018-18546?

Yes, you can find references for CVE-2018-18546 at the following links: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-18546), [GitHub](https://github.com/top-think/thinkphp/commit/9748cb80d2f24c89218f358ca2f5ab88ee33396f), [Blog](https://98587329.github.io/2018/10/09/thinkphp%E6%B3%A8%E5%85%A5%E5%88%86%E6%9E%90/).

Published Oct 21, 2018

Updated

ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable.

Other sources

ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable.

Affected Software

2 affected components

composer/topthink/framework<=3.2.4

ThinkPHP ThinkPHP=3.2.4

Remediation

Patch Available

https://github.com/top-think/thinkphp/commit/9748cb80d2f24c89218f358ca2f5ab88ee33396f

Event History

Oct 21, 2018

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

May 14, 2022

Advisory Published

01:53 AM

Frequently Asked Questions

What is CVE-2018-18546?