CVE-2018-16385 ThinkPHP SQL Injection vulnerability

Critical 9.8 Published 3 Sep 2018 Updated 5 Aug 2024

Attackers can execute arbitrary SQL commands via the test index query string in ThinkPHP, potentially reading or modifying database contents.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-16385?

CVE-2018-16385 is a critical SQL injection vulnerability in n/a, published on 3 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.

Weakness: CWE-89

Which versions are affected by CVE-2018-16385?

2 open source packages ship an affected version, including topthink/framework. It affects 1 product.

Package	Affected	Fixed in
`topthink/framework` Packagist	All versions	`5.1.23`
`topthink/framework` Packagist	All versions	`5.1.23`

Products include Thinkphp Thinkphp.

How do I fix CVE-2018-16385?

Upgrade topthink/framework to 5.1.23 or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2018-16385 being exploited?

There is no known exploitation of CVE-2018-16385 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-vcm7-88jx-3r39.