ThinkPHP deserialization vulnerability
EIP currently links 2 repository PoCs and 1 lab environment to CVE-2024-44902.
A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
| Product | Source | Version range | Status |
|---|---|---|---|
ThinkPHPBrowse thinkphp / ThinkPHPDefault status: unknown | VulnCheck, CVE List | 6.1.3 to < 8.0.4 | affected |
topthink/frameworkBrowse Packagist / topthink/framework | GitHub Advisory | 6.1.3 to ≤ 8.0.4 | affected |
The artifact is a deliberately vulnerable ThinkPHP environment designed for validating a nuclei template scanner. It contains a vulnerable application with insecure deserialization endpoints but no exploit or scanner code itself.
No backdoor observed in reviewed code
The repository is a deliberately vulnerable ThinkPHP environment for CVE-2024-44902 validation. The reviewed text files (README, controllers, route) describe and implement the intended insecure deserialization vulnerability. No concealed backdoor, deceptive payload, or operator-directed harm is present in the supplied evidence.
The artifact is a vulnerable environment for validating a nuclei template, as stated in the README. It contains no exploit or scanner code; the nuclei template is referenced but not included. The application code only provides the vulnerable target.
README.md:3README.md:40README.md:40app/controller/Api.php:38app/controller/Api.php:64README.md:54route/app.php:10app/controller/Api.php:56-64route/app.php:9app/controller/Api.php:27-38This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
A Docker Compose environment that builds and runs a ThinkPHP 8.0.4 web application with a deliberately vulnerable API controller. The environment is intended for validating a nuclei template for CVE-2024-44902, an insecure deserialization vulnerability.
README.md:1-3docker-compose.yml:1-4The README explicitly states the environment is a 'Vulnerable environment for nuclei-templates validation' and 'DELIBERATELY VULNERABLE environment for security testing ONLY'. The Dockerfile and application code implement a ThinkPHP instance with an endpoint that calls unserialize() on user input, matching the described CVE-2024-44902.
README.md:1-3README.md:85-90app/controller/Api.php:30-35A single Docker Compose service built from the local Dockerfile. It exposes port 8080 on the host, mapping to container port 80. The service runs a ThinkPHP 8.0.4 application with Apache, intended to be tested with a nuclei template for CVE-2024-44902.
docker-compose.yml:10-20README.md:1-3Starts from php:8.0.7-apache, installs Memcached extension, creates a ThinkPHP project with topthink/framework:8.0.4, copies custom application code (app/ and route/), and configures Apache to serve the public directory.
Dockerfile:1-46A PHP controller with two methods (sync and import) that accept user-supplied data and pass it to unserialize(). The import method is explicitly called out in the README as the vulnerable endpoint.
app/controller/Api.php:1-74README.md:55A simple controller that returns an HTML string indicating the application is running. Provides a basic check that the service is up.
app/controller/Index.php:1-14Maps the root path to Index/index and creates an 'api' group with routes for 'sync' and 'import' that accept any HTTP method, matching the vulnerable controller methods.
route/app.php:1-14Supported by supplied evidence
The environment matches the CVE description: it runs ThinkPHP 8.0.4 (an affected version), has the Memcached extension installed, and provides an endpoint that unserializes user input, which is the described vulnerability.
Dockerfile:16Dockerfile:26-28app/controller/Api.php:30-35README.md:13-17README.md:27-30README.md:35-37README.md:27-30README.md:35-36README.md:37README.md:55All visible behavior is directed at the contained lab target. The Dockerfile builds a deliberately vulnerable ThinkPHP instance, the Compose file maps a port for local testing, and the application code implements the described deserialization sink. No hidden, destructive, or external actions are present. The README explicitly warns against production use and states the environment is for security testing only.
README.md:85-90docker-compose.yml:10-20Dockerfile:1-46This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.