CVE-2018-19896: SQL Injection
Published Dec 6, 2018
·Updated
ThinkCMF X2.2.2 has SQL Injection via the function delete() in SlideController.class.php and is exploitable with the manager privilege via the ids[] parameter in a slide action.
Affected Software
1 affected component
ThinkCMF ThinkCMF=x2.2.2
Event History
Dec 6, 2018
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is CVE-2018-19896?
CVE-2018-19896 is a vulnerability in ThinkCMF X2.2.2 that allows SQL Injection through the delete() function in SlideController.class.php.
2
How severe is CVE-2018-19896?
CVE-2018-19896 has a severity level of 7.2 (high).
3
How can I exploit CVE-2018-19896?
CVE-2018-19896 can be exploited by an attacker with manager privilege by manipulating the ids[] parameter in a slide action.
4
What software versions are affected by CVE-2018-19896?
ThinkCMF X2.2.2 is the affected version.
5
Is there a fix for CVE-2018-19896?
To fix CVE-2018-19896, it is recommended to update to a patched version of ThinkCMF.