CVE-2018-16385

ThinkPHP SQL Injection vulnerability

9.8 CriticalPublic exploitFix available

CVE-2018-16385 is a critical vulnerability (CVSS 9.8) in Thinkphp, published September 3, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.15%, the 82nd percentile. Fixed in topthink/framework 5.1.23.

ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.15%Up 1.7 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.

Record: CVE-2018-16385
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-89
Updated: 2026-11-02

CVE List No score

ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.

Record: CVE-2018-16385
Updated: 2026-11-02

EUVDEUVD-2022-5342 No score

ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.

Record: EUVD-2022-5342
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vcm7-88jx-3r39 9.8

ThinkPHP SQL Injection vulnerability

ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.

Record: GHSA-vcm7-88jx-3r39
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

OSV 9.8

ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.

Record: CVE-2018-16385
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-vcm7-88jx-3r39 9.8

ThinkPHP SQL Injection vulnerability

ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.

Record: GHSA-vcm7-88jx-3r39
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

Affected products

thinkphp

Affected packages

Affected packages
Package	Affected	Fixed
`topthink/framework` Packagist	before 5.1.23	5.1.23
`topthink/framework` Packagist	before 5.1.23, plus listed versions 5.05.0-rc15.0-rc25.0-rc35.0-rc4 Show 45 moreShow less v5.0.1v5.0.10v5.0.11v5.0.12v5.0.13v5.0.14v5.0.15v5.0.16v5.0.17v5.0.18v5.0.19v5.0.2v5.0.20v5.0.21v5.0.22v5.0.23v5.0.24v5.0.25v5.0.3v5.0.4v5.0.5v5.0.6v5.0.7v5.0.8v5.0.9v5.1-beta.1v5.1-rc.1v5.1-rc.2v5.1-rc.3v5.1.0v5.1.1v5.1.10v5.1.11v5.1.12v5.1.13v5.1.14v5.1.15v5.1.16v5.1.17v5.1.18v5.1.19v5.1.2v5.1.20v5.1.21v5.1.22	5.1.23

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	buzhimingdeaikun/SQL-ThinkPHP-5.0.24-RCE-	2026-07-13

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

References

This page doesn't list everything

Left out here: 7 versions. The JSON record has them.