CVE-2018-16385

Description

ThinkPHP before 5.1.23 allows SQL Injection via the `public/index/index/test/index` query string.

How to fix CVE-2018-16385

To remediate CVE-2018-16385, upgrade the affected package to a fixed version below.

• Packagist/topthink/framework—upgrade to 5.1.23 or later

Is CVE-2018-16385 being exploited?

Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 5.1.23

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-16385
• PATCHgithub.com/top-think/framework
• WEBexchange.xforce.ibmcloud.com/vulnerabilities/149288
• WEBgithub.com/top-think/framework/issues/1375