ThinkAdmin Administrator cookies still working after password change

CRITICAL 9.8CVE-2019-11018 · GHSA-qv5j-rwq3-m823 · Published 08/04/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
zoujingli/thinkadmin Packagist	`= 4.0`	No fix yet
thinkadmin thinkadmin	`= 4.0`	No fix yet

Description

application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change.

NVD description

application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change.

References

nvd.nist.gov/vuln/detail/CVE-2019-11018 · ADVISORY
zoujingli/ThinkAdmin · WEB
zoujingli/ThinkAdmin · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free