CVE-2019-9082
HIGH KEV NUCLEIThinkPHP < 3.2.4 - Remote Code Execution via Public Endpoint
Title source: llmExploitation Summary
CVE-2019-9082 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021. EIP tracks 2 public exploits from researchers including Metasploit, Yang Chenglong. A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits PHP injection vulnerabilities in ThinkPHP versions up to 5.0.23 to achieve remote code execution. It includes version detection and payload delivery mechanisms for both Unix commands and Linux droppers.
Description
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.
Exploits (2)
This Metasploit module exploits PHP injection vulnerabilities in ThinkPHP versions up to 5.0.23 to achieve remote code execution. It includes version detection and payload delivery mechanisms for both Unix commands and Linux droppers.
This exploit demonstrates a CSRF vulnerability in zzzphp CMS 1.6.1, allowing attackers to inject malicious code into template files via a crafted POST request, leading to dynamic code evaluation. The PoC is a functional HTML form that automates the attack when visited by an authenticated admin.
Nuclei Templates (1)
app="ThinkPHP"
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H