CVE-2021-44350
📋 TL;DR
This SQL injection vulnerability in ThinkPHP5 allows attackers to execute arbitrary SQL commands through the parseOrder function. It affects all ThinkPHP5 applications using versions 5.0.x through 5.1.22. Attackers can potentially read, modify, or delete database contents.
💻 Affected Systems
- ThinkPHP5
📦 What is this software?
Thinkphp by Thinkphp
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via subsequent attacks.
Likely Case
Unauthorized data access, data manipulation, or privilege escalation within the database.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage scope.
🎯 Exploit Status
SQL injection via order parameter requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.1.23
Vendor Advisory: https://github.com/top-think/framework/issues/2613
Restart Required: No
Instructions:
1. Update ThinkPHP5 framework to version 5.1.23 or later. 2. Replace the framework directory with patched version. 3. Clear any cached files. 4. Test application functionality.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for order parameters before passing to parseOrder function.
Database Permission Reduction
allRestrict database user permissions to minimum required operations.
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection rules
- Disable or restrict order functionality in affected endpoints
🔍 How to Verify
Check if Vulnerable:
Check ThinkPHP5 framework version in vendor/topthink/framework directory or composer.json.Check Version:
cat vendor/topthink/framework/src/think/App.php | grep 'const VERSION'Verify Fix Applied:
Confirm framework version is 5.1.23 or higher and test order functionality with malicious inputs.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed order parameter attempts
- SQL syntax errors in application logs
Network Indicators:
- HTTP requests with unusual order parameters containing SQL keywords
SIEM Query:
source="web_logs" AND (order* OR ORDER*) AND (SELECT OR UNION OR INSERT OR DELETE)