CVE-2022-44289

Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell...

The vulnerability of the ThinkPHP framework, related to improper code generation management, allows attackers to execute arbitrary commands.

The vulnerability of the ThinkPHP framework is related to incorrect code generation when using the “\” delimiter in the controller name. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

ThinkPHP Code Problem Vulnerability (CNVD-2021-100294)

Top Thinking Information Technology ThinkPHP is a PHP-based, open source, lightweight Web application development framework from China Top Thinking Information Technology. A code issue vulnerability exists in ThinkPHP v6.0.8, which stems from the component LeagueFlysystemCachedStorageAbstractCach...

CVE-2020-20120

ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" methods...

The vulnerability of the thinkphp/library/think/App.php component in the ThinkPHP framework allows a attacker to execute arbitrary PHP code on the target system.

The vulnerability of the thinkphp/library/think/App.php component in the ThinkPHP framework is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary PHP code on the target system remotely...

TP-COUPON suffers from SQL injection vulnerability (CNVD-2021-23515)

TP-COUPON is a free and open source coupon system developed using the Thinkphp framework. TP-COUPON suffers from a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...

fastadmin SQL Injection Vulnerability

fastadmin is a web backend development framework based on ThinkPHP and Bootstrap. A SQL injection vulnerability exists in fastadmin-tp6 v1.0, which originates in the app management controller Ajax.php file, where the passed table parameters are not filtered. An attacker can exploit this...

TuziCMS v3.0 do***_pc*** has a command execution vulnerability

TuziCMS is an enterprise website management system based on ThinkPHP 3.2 framework. TuziCMS v3.0 dopc has a command execution vulnerability that can be exploited by an attacker to gain control of the server...

File Upload Vulnerability in 115CMS

115CMS hereinafter referred to as this product is developed on the face of the most popular current ThinkPHP framework, which is an efficient and open source content management system. 115CMS has a file upload vulnerability that can be exploited by attackers to gain access to the server...

Arbitrary File Read Vulnerability in Chengdu Leader City Information Technology Co.

Chengdu Leader City Information Technology Co., Ltd. builds its website system using ThinkPHP. Chengdu Leader Information Technology Co., Ltd. building system there is an arbitrary file reading vulnerability, an attacker can use this vulnerability to remotely connect to the database, read the TP...

SQL Injection Vulnerability in CRMEB Mall System Backend Sy***.php Page

CRMEB mall system is a new retail mobile e-commerce system developed based on ThinkPhp6.0+Vue. CRMEB mall system background Sy.php page SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information...

NiuShop suffers from SQL injection vulnerability (CNVD-2019-43348)

Niushop open source mall using thinkphp5.0 MySQL development language development , completely open source mall system , can be used for enterprises , individuals to establish their own online free mall , support for open source WeChat Mall , open source applet , open source new retail , B2B2C,...

Directory Traversal Vulnerability in RGCMS

RuiGu information management system RGCMS is a set of open source building management system, using PHP language, written in the framework of Thinkphp5.1.+, the database using MYSQL database. RGCMS has a directory traversal vulnerability that can be exploited by an attacker to view the list of...

CVE-2019-9082

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=calluserfuncarray&vars0=system&vars1= followed by the command...

This Week in Security News: Hacker Strategies and Spyware Attacks

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about how hackers are improving their breach strategies. Also, learn about new spyware attacks via URLs, websites, and mobile apps. Re...

PT-2018-3751

Name of the Vulnerable Software and Affected Versions NoneCms version 1.3 Description An issue in thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter. This is demonstrated by the query string...

SQL injection vulnerability in CollectController.class.php page of Thunderwind Movie & TV cms system

Thunderwind Movie CMS is a PHP based THINKPHP3.2.3 framework development, suitable for all kinds of video, film and television websites, film and television content management program. Thunderwind Film and Television CMS system CollectController.class.php page SQL injection vulnerability, attacke...

ThinkPHP 3.0~3.2 SQL injection vulnerability in detail and use-vulnerability and early warning-the black bar safety net

! ThinkPHP 3.03.2 a target=SQL injection vulnerability in detail with the use of" style="border: 0px;" onload="return imgzoomthis,5 5 0;" onclick="javascript:window. openthis. src;" style="cursor:pointer;"/ 0x00 background thinkphp recent vulnerability frequency, this exploit belongs to the...

New Oriental OA system patches timely thinkphp vulnerability to execute arbitrary system commands(getshell)-vulnerability warning-the black bar safety net

Brief description: New Oriental OA system patch is not timely, the thinkphp vulnerability to execute arbitrary system commandsgetshell Detailed description: ! https://. xdf. cn/mapp/index. php/module/action/param1/$%7B@printvardumpDAdmin-%3Eselect%7D The results are as follows: --------- array1 0...

看我如何调查放置后门之Thinkphp

简要描述： 提交这个我纠结了很久，本来我是可以做一个坏帽子，贼喊捉贼，昨天晚上想了想，我的偶像猪猪侠提交的那些漏洞和我这比我这就是渣渣，他都可以无私的提交而不去换取不正当的金钱，我为什么就不可以呢？这个应该属于通用漏洞奖励鸟 详细说明： 渗透thinkphp完全是因为无聊之余搞了搞，可是没想到的还搞进去了，呵呵，首先在一个群里面发现别人发了一个thinkphp的连接 打开是一个压缩包 800多MB就下载了 可是下载速度我不敢恭维啊，几KB几十KB每秒，呵呵。 下了四个小时才下载完，下载了那么久，当然要看看里面的东西，源码，呵呵这安全运维可真厉害，在里面找到了一个config...