CVE-2018-19895: SQL Injection
Published Dec 6, 2018
·Updated
ThinkCMF X2.2.2 has SQL Injection via the function editpost() in NavController.class.php and is exploitable with the manager privilege via the parentid parameter in a nav action.
Affected Software
1 affected component
ThinkCMF ThinkCMF=x2.2.2
Event History
Dec 6, 2018
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-19895?
CVE-2018-19895 is classified as a medium severity SQL Injection vulnerability.
2
How do I fix CVE-2018-19895?
To fix CVE-2018-19895, you should upgrade ThinkCMF to the latest version that patches the SQL injection vulnerability.
3
What software is affected by CVE-2018-19895?
CVE-2018-19895 specifically affects ThinkCMF version X2.2.2.
4
Can CVE-2018-19895 be exploited easily?
Yes, CVE-2018-19895 can be exploited easily with manager privileges using the parentid parameter.
5
What is the main impact of CVE-2018-19895?
The main impact of CVE-2018-19895 is unauthorized access to the database through SQL injection.