PT-2018-15147
CVE-2018-19895
·
Published
2018-12-06
·
Updated
2018-12-26
Description by
CVSS 3.1
7.2
HighMetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
ThinkCMF version X2.2.2
Description
The issue is related to SQL Injection via the
edit post() function in NavController.class.php. It can be exploited with manager privilege using the parentid parameter in a "nav" action.Recommendations
For ThinkCMF version X2.2.2, consider disabling the
edit post() function in NavController.class.php until a patch is available to prevent exploitation via the parentid parameter. Restrict access to the "nav" action to minimize the risk of SQL Injection.Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾