CVE-2018-19897: SQL Injection
Published Dec 6, 2018
·Updated
ThinkCMF X2.2.2 has SQL Injection via the function listorders() in AdminbaseController.class.php and is exploitable with the manager privilege via the listorders[key][1] parameter in a Link listorders action.
Affected Software
1 affected component
ThinkCMF ThinkCMF=x2.2.2
Event History
Dec 6, 2018
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-19897?
CVE-2018-19897 has a medium severity level due to its potential for SQL Injection attacks.
2
How can I mitigate CVE-2018-19897?
To mitigate CVE-2018-19897, ensure that input validation and parameterized queries are implemented properly in the application.
3
What are the consequences of exploiting CVE-2018-19897?
Exploiting CVE-2018-19897 can allow an attacker to execute arbitrary SQL commands, potentially leading to unauthorized data access.
4
Which versions of ThinkCMF are affected by CVE-2018-19897?
CVE-2018-19897 specifically affects ThinkCMF version x2.2.2.
5
What feature is vulnerable in CVE-2018-19897?
CVE-2018-19897 is vulnerable through the function _listorders() in the AdminbaseController.class.php.