CVE-2020-21176 – SQL injection vulnerability in the model.increment and model.decrement fu

SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-21176

Reference (s):

• https://blog.jiguang.xyz/posts/thinkjs-sql-injection/
• https://github.com/thinkjs/thinkjs