CVE-2018-20062

CVE-2018-20062 ThinkPHP 5.0.23 - CVE-2018-20062 影响验证 受影响版本 ThinkPHP 5.0.x 5.0.23（invokefunction 反序列化） 验证方法 针对此 CVE 的标准影响评估遵循两阶段方法： 1. 存在性检查 — 确认 invokefunction 路由可访问 2. 影响验证 — 执行标准 PoC 并记录 代码运行所在的进程上下文 第 2 阶段在 verifyimpact.sh 中自动化完成，该脚本捕获 完整的 CVE 影响报告所需的执行上下文（uid、主机名、内核）。 使用方法 验证部署的暴露情况，然后执行验证脚本：...

Exploit for CVE-2018-20062

CVE-2018-20062 ThinkPHP 5.0.23 - CVE-2018-20062 Impact Verif...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the invokefunction process. An attacker can execute arbitrary PHP code by sending specially crafted requests to the index.php endpoint with malicious function parameters. Remediation...

CVE-2018-25270 ThinkPHP 5.0.23 Remote Code Execution via invokefunction

ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system...

CVE-2019-9082: Improper Control of Generation of Code

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=calluserfuncarray&vars0=system&vars1= followed by the command...