CVE-2019-7580
HIGH EXPLOITEDThinkCMF 5.0.190111 - Remote Code Execution via Portal Admin Category Alias Parameter
Title source: llmExploitation Summary
CVE-2019-7580 has been observed exploited in the wild (reported by VulnCheck KEV).
Description
ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin_category/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection.
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://xz.aliyun.com/t/3997
Exploit, Third Party Advisory x_refsource_misc
https://github.com/shadowsock5/ThinkCMF-5.0.190111/blob/master/README.md
Scores
CVSS v3
8.8
EPSS
0.0993
EPSS Percentile
95.0%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
VulnCheck KEV
2023-07-05
CWE
CWE-94
Status
published
Products (1)
thinkcmf/thinkcmf
5.0.190111
Published
Feb 07, 2019
Tracked Since
Feb 18, 2026