CVE-2022-25481

HIGH NUCLEI

ThinkPHP Framework 5.0.24 - Unauthenticated Information Exposure via PATHINFO Misconfiguration

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-25481 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode.

Nuclei Templates (1)

ThinkPHP 5.0.24 - Information Disclosure
HIGHVERIFIEDby caon
Shodan: title:"ThinkPHP" || http.title:"thinkphp" || cpe:"cpe:2.3:a:thinkphp:thinkphp"
FOFA: title="thinkphp" || header="think_lang"

References (1)

Core 1

Scores

CVSS v3 7.5
EPSS 0.0475
EPSS Percentile 90.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-284 CWE-668
Status published
Products (2)
thinkphp/thinkphp 5.0.24
topthink/framework 0Packagist
Published Mar 21, 2022
Tracked Since Feb 18, 2026