smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line

Summary parse has a quadratic-time path in parseKey, reachable on default options with ordinary valid input. For every key line and table-header line, parseKey dist/struct.js, lines 58 and 86 finds the dotted-key separator with ctx.s.indexOf'.', ctx.p, where ctx.s is the whole document. When a ke...

NPM: smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line

NPM: smol-toml: Quadratic-time parse from parseKey rescanning to end of document on each key line vulnerability discovered by ? in WordPress Npm smol-toml versions = 1.8.0...

GHSA-R4XH-JQRQ-34V2 smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line

Summary parse has a quadratic-time path in parseKey, reachable on default options with ordinary valid input. For every key line and table-header line, parseKey dist/struct.js, lines 58 and 86 finds the dotted-key separator with ctx.s.indexOf'.', ctx.p, where ctx.s is the whole document. When a ke...

ThinkPHP SQLi Vulnerability

ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI...

GHSA-78Q9-24GV-G288 ThinkPHP SQLi Vulnerability

ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI...

ThinkPHP SQL Injection Vulnerability (CNVD-2018-21507)

ThinkPHP is an open source, lightweight PHP-based web application development framework. A SQL injection vulnerability exists in ThinkPHP version 3.2.4, which stems from the failure of the 'parseKey' function to properly handle the variable key.A remote attacker can exploit this vulnerability to...

Sql injection

ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI...

CVE-2018-18529

ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI...

CVE-2018-18529

ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI...

CVE-2018-18529

ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI...

CVE-2018-18529

ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI...

CVE-2018-18529: Improper Neutralization of Special Elements used in an SQL Command

ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI...

PT-2018-14496

Name of the Vulnerable Software and Affected Versions ThinkPHP version 3.2.4 Description The issue is related to SQL Injection via the count parameter. This occurs because the parseKey function in the Library/Think/Db/Driver/Mysql.class.php file mishandles the key variable. It is noted that a...