An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet.

ThinkCMF X2.2.2 has SQL Injection via the function listorders() in AdminbaseController.class.php and is exploitable with the manager privilege via the listorders[key][1] parameter in a Link listorders action.

ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is exploitable with the manager privilege via the ids[] parameter in a commentadmin action.

ThinkCMF X2.2.2 has SQL Injection via the method editpost in ArticleController.class.php and is exploitable by normal authenticated users via the post[id][1] parameter in an article editpost action.