ThinkPHP Framework vulnerable to remote code execution

2022-12-2321:30:17

Google

osv.dev

thinkphp

framework

remote code execution

vulnerability

operating system commands

unauthenticated

remote attacker

file inclusion

language pack

version 6.0.14

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.048 Low

EPSS

Percentile

92.8%

JSON

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.

CPENameOperatorVersion
topthink/frameworkeq5.1.11
topthink/frameworkeq5.0.25
topthink/frameworkeq5.1.30
topthink/frameworkeq6.0.3
topthink/frameworkeq5.1.41
topthink/frameworkeq5.1.1
topthink/frameworkeq6.0.0-rc3
topthink/frameworkeq5.0.20
topthink/frameworkeq5.0.14
topthink/frameworkeq5.0.17

Name	Operator	Version
topthink/framework	eq	5.1.11
topthink/framework	eq	5.0.25
topthink/framework	eq	5.1.30
topthink/framework	eq	6.0.3
topthink/framework	eq	5.1.41
topthink/framework	eq	5.1.1
topthink/framework	eq	6.0.0-rc3
topthink/framework	eq	5.0.20
topthink/framework	eq	5.0.14
topthink/framework	eq	5.0.17