thinkphp

3 exploits Active since Oct 2018
CVE-2018-18546 WRITEUP CRITICAL WRITEUP
ThinkPHP 3.2.4 - SQL Injection via Order Parameter
ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable.
CVSS 9.8
CVE-2021-23592 WRITEUP HIGH WRITEUP
thinkphp < 6.0.12 - Deserialization of Untrusted Data via Insecure Unserialize Method
The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class.
CVSS 7.7
CVE-2022-47945 WRITEUP CRITICAL WRITEUP
ThinkPHP Framework < 6.0.14 - Unauthenticated Local File Inclusion via Lang Parameter
ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.
CVSS 9.8