Description
ThinkPHP 3.2.4之前版本（使用在Open Source BMS v1.1.1版本和其他设备上）中存在输入验证漏洞。远程攻击者可借助public//?s=index/ thinkapp/invokefunction＆function=call_user_func_array＆vars[0]=system＆vars[1][]= URL利用该漏洞执行命令。
ThinkPHP < 5.0.24/5.1.33远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://stack.chaitin.com/vuldb/detail/19b92bc4-9d03-4394-8f50-5c2ef3a05d36
https://blog.csdn.net/qq_67473072/article/details/131696323
https://github.com/oneoy/thinkphp-RCE-POC
https://www.cnblogs.com/lxwphp/p/10455824.html
https://y4er.com/posts/thinkphp5-rce/
https://developer.aliyun.com/article/686397
https://www.abc.edu.cn/imc/xxy/1355/27791.html
https://learnku.com/articles/21227
https://blog.nsfocus.net/thinkphp-5-0-5-0-23-rce/
https://www.exploit-db.com/exploits/46150
https://nvd.nist.gov/vuln/detail/CVE-2018-20062