CVE-2018-18546
CVE-2018-18546
This page contains facts from public vulnerability sources. Check the original advisory before updating.
ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable.
CVSS 9.8 · Critical · EPSS 1.7%
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
topthink/framework Packagist
- Affected ranges
- ECOSYSTEM: ≤ 3.2.4
No fix published