CVE-2022-47945

2022-12-2300:00:00

mitre

www.cve.org

cve-2022-47945

thinkphp

file inclusion

language pack

remote attacker

arbitrary commands

9.7 High

AI Score

Confidence

High

0.048 Low

EPSS

Percentile

92.8%

JSON

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.