SQL Injection Vulnerability in ThinkPHP ZCMS
CVE-2020-19705

9.8CRITICAL

Key Information:

Vendor

ThinkPHP-zcms Project

Status
ThinkPHP-zcms
Vendor
CVE Published:
26 August 2021

What is CVE-2020-19705?

The ThinkPHP ZCMS web application, observed in versions up to 20190715, is susceptible to an SQL injection vulnerability. This issue arises when handling user input in the 'index.php' file, specifically through the 'm', 'c', 'a' parameters. An attacker can inject malicious SQL code, potentially allowing unauthorized access to the database, data manipulation, or even control over the affected server's backend processes. It's crucial for users and administrators to patch this vulnerability to safeguard their applications against potential exploitation.

References

https://github.com/jorycn/thinkphp-zcms/issues/2
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.