GHSA-m7h5-fjjq-559f

Suggest an improvement
Source
https://github.com/advisories/GHSA-m7h5-fjjq-559f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-m7h5-fjjq-559f/GHSA-m7h5-fjjq-559f.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-m7h5-fjjq-559f
Aliases
Published
2021-09-30T17:11:11Z
Modified
2023-11-01T04:52:15.834930Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
SQL Injection in topthink/thinkphp
Details

ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" methods.

Database specific
{
    "nvd_published_at": "2021-09-28T23:15:00Z",
    "github_reviewed_at": "2021-09-30T16:59:44Z",
    "severity": "CRITICAL",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-89"
    ]
}
References

Affected packages

Packagist / topthink/thinkphp

Package

Name
topthink/thinkphp
Purl
pkg:composer/topthink/thinkphp

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
3.2.3

Affected versions

3.*

3.2.2
3.2.3