ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| topthink/framework(Packagist) | 0 | N/A | N/A |
CVSS Metrics
