CVE-2019-9082

This Metasploit module exploits PHP injection vulnerabilities in ThinkPHP versions up to 5.0.23 to achieve remote code execution. It includes version detection and payload delivery mechanisms for both Unix commands and Linux droppers.

This exploit demonstrates a CSRF vulnerability in zzzphp CMS 1.6.1, allowing attackers to inject malicious code into template files via a crafted POST request, leading to dynamic code evaluation. The PoC is a functional HTML form that automates the attack when visited by an authenticated admin.