CVE-2018-18546

2018-10-2101:29:00

Google

osv.dev

8.2 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

55.8%

JSON

ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable.

CPENameOperatorVersion
thinkphpeq3.2.0
thinkphpeq3.2.1
thinkphpeq3.2.4
thinkphpeq3.1.0
thinkphpeq3.2.2
thinkphpeq3.2.3
thinkphpeq3.1.2
thinkphpeq3.1.3