ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate variable. NOTE: a backquote character is required in the attack URI.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| topthink/framework(Packagist) | 0 | N/A | N/A |
CVSS Metrics
