CVE-2018-19894

ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is exploitable with the manager privilege via the ids[] parameter in a commentadmin action.

Score

CVSS 3.0 7.2 High

Status

Modified - cve@mitre.org

Published

2018-12-06

Last modified

2024-09-17

Weaknesses

CWE-89

Affected products

• Thinkcmf (Thinkcmf)

References

• https://github.com/thinkcmf/cmfx/issues/26