ThinkPHP SQL injection vulnerability

CRÍTICO 9.8CVE-2018-17566 · GHSA-75fm-52mm-q5rm · Published 26/09/2018 · updated 17/06/2026

Em resumo

CVE-2018-17566 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta topthink/framework, thinkphp (thinkphp).
Chance de exploração nos próximos 30 dias (EPSS): 1.5%, maior que 74.9% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
topthink/framework Packagist	`= 5.1.24`	No fix yet
thinkphp thinkphp	`= 5.1.24`	No fix yet

In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request.

NVD description

In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

= 5.1.24

No fix yet

= 5.1.24

No fix yet

Description

In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request.

NVD description

In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request.

Mais vulnerabilidades de topthink/framework

Ver tudo →