CVE-2018-19894: SQL Injection

Published Dec 6, 2018

Updated

ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is exploitable with the manager privilege via the ids[] parameter in a commentadmin action.

Affected Software

1 affected component

ThinkCMF ThinkCMF=x2.2.2

Event History

Dec 6, 2018

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2018-19894?

CVE-2018-19894 has a high severity rating due to the potential for SQL Injection attacks that can lead to data exposure or manipulation.

How do I fix CVE-2018-19894?

To fix CVE-2018-19894, update to a newer version of ThinkCMF that addresses the SQL Injection vulnerability.

What are the affected components in CVE-2018-19894?

CVE-2018-19894 affects the CommentadminController.class.php file in ThinkCMF version x2.2.2.

Can CVE-2018-19894 be exploited remotely?

Yes, CVE-2018-19894 can be exploited remotely by an attacker with manager privileges via the ids[] parameter.

What types of attacks can CVE-2018-19894 facilitate?

CVE-2018-19894 can facilitate SQL Injection attacks, potentially allowing attackers to execute arbitrary SQL queries in the database.