GHSA-m7h5-fjjq-559f

ghsaUSosv

SQL Injection in topthink/thinkphp

view advisory published 2021-09-30Licence: CC-BY-4.0

ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" methods.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-20120US	critical9.8	1.82% (79th)	—	2021-09-28
ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" methods.

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.