Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
top-think/think
8.x @ 49917ae
9
Fixes
22
CVEs
CRITICAL
Peak severity
Highlights
SQL Injection: 3 prior fixes. Scrutinize any change in this area.
thinkphp/Library/Think/App.php: most-fixed (2 issues). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Remote Code Execution: The application dispatcher failed to sanitize the controller name variable, allowing remote attackers to instantiate arbitrary classes and execute arbitrary PHP code. Strict regular expression validation is required to restrict class loading.
SQL Injection: Using standard string escaping like addslashes instead of full PDO-driven identifier and parameter quoting allowed malicious payloads to break SQL syntax boundaries, particularly during sorting or order-by parsing.
SQL Injection: Standard database wrapper queries executed without bound parameters inside internal driver or model traits allowed SQL injection when user-supplied criteria were passed directly into compiled queries.