p PatchFirst

CVE-2018-18530

CVE-2018-18530

This page contains facts from public vulnerability sources. Check the original advisory before updating.

ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate variable. NOTE: a backquote character is required in the attack URI.

CVSS 9.8 · Critical · EPSS 1.2%

Published
Updated

Stack: php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • topthink/framework Packagist

    Versions
    • 5.0
    • 5.0-rc1
    • 5.0-rc2
    • 5.0-rc3
    • 5.0-rc4
    • v5.0.1
    • v5.0.10
    • v5.0.11
    • v5.0.12
    • v5.0.13
    • v5.0.14
    • v5.0.15
    • v5.0.16
    • v5.0.17
    • v5.0.18
    • v5.0.19
    • v5.0.2
    • v5.0.20
    • v5.0.21
    • v5.0.22
    • v5.0.23
    • v5.0.24
    • v5.0.25
    • v5.0.3
    • v5.0.4
    • v5.0.5
    • v5.0.6
    • v5.0.7
    • v5.0.8
    • v5.0.9
    • v5.1-beta.1
    • v5.1-rc.1
    • v5.1-rc.2
    • v5.1-rc.3
    • v5.1.0
    • v5.1.1
    • v5.1.10
    • v5.1.11
    • v5.1.12
    • v5.1.13
    • v5.1.14
    • v5.1.15
    • v5.1.16
    • v5.1.17
    • v5.1.18
    • v5.1.19
    • v5.1.2
    • v5.1.20
    • v5.1.21
    • v5.1.22
    • v5.1.23
    • v5.1.24
    • v5.1.25
    • v5.1.3
    • v5.1.4
    • v5.1.5
    • v5.1.6
    • v5.1.7
    • v5.1.8
    • v5.1.9
    Affected ranges
    • ECOSYSTEM: ≤ 5.1.25

    No fix published

Original sources

Check your server →