Description
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
ThinkPHP Multiple PHP Injection RCEs
exploit/unix/webapp/thinkphp_rce
Exploit-DB 2
- ThinkPHP - Multiple PHP Injection RCEs (Metasploit) EDB-48333 · remote · Apr 16, 2020 · verified
- zzzphp CMS 1.6.1 - Cross-Site Request Forgery EDB-46488 · webapps · Mar 4, 2019
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- ThinkPHP < 3.2.4 - Remote Code Execution http/cves/2019/CVE-2019-9082.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.