Vulnerability Description
ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Thinkphp | Thinkphp | >= 5.0.0, < 5.0.23 |
Related Weaknesses (CWE)
References
- https://github.com/top-think/framework/Product
- https://thinkphp.cnBroken Link
- https://www.exploit-db.com/exploits/45978ExploitThird Party AdvisoryVDB Entry
- https://www.vulncheck.com/advisories/thinkphp-remote-code-execution-via-invokefuThird Party Advisory
FAQ
What is CVE-2018-25270?
CVE-2018-25270 is a vulnerability with a CVSS score of 9.8 (CRITICAL). ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can cr...
How severe is CVE-2018-25270?
CVE-2018-25270 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2018-25270?
Check the references section above for vendor advisories and patch information. Affected products include: Thinkphp Thinkphp.