CVE-2018-19898: SQL Injection
Published Dec 6, 2018
·Updated
ThinkCMF X2.2.2 has SQL Injection via the method editpost in ArticleController.class.php and is exploitable by normal authenticated users via the post[id][1] parameter in an article editpost action.
Affected Software
1 affected component
ThinkCMF ThinkCMF=x2.2.2
Event History
Dec 6, 2018
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-19898?
CVE-2018-19898 is classified as a medium severity SQL Injection vulnerability.
2
How do I fix CVE-2018-19898?
To fix CVE-2018-19898, update to the latest version of ThinkCMF beyond X2.2.2 where the vulnerability is patched.
3
Who is affected by CVE-2018-19898?
Any user with access to the ThinkCMF X2.2.2 application is potentially affected by CVE-2018-19898.
4
What types of attacks can exploit CVE-2018-19898?
Attackers can exploit CVE-2018-19898 using SQL Injection techniques via crafted input in the edit_post action.
5
What are the potential impacts of CVE-2018-19898?
Exploitation of CVE-2018-19898 can lead to unauthorized data access and manipulation of the database.