Description
ThinkPHP Controller 代码注入漏洞（漏洞编号：CNVD-2018-24942）指由于 ThinkPHP 框架对控制器名没有进行足够严格的安全检测，导致在没有开启强制路由的情况下，攻击者可以构造特定的请求在服务端注入恶意代码。该漏洞会导致攻击者可以在服务器上执行任意的攻击代码，窃取服务器上的敏感信息甚至通过系统提权方式控制服务器，危害十分严重。
ThinkPHP InvokeFunction 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://stack.chaitin.com/vuldb/detail/5a075e93-dced-4a72-94b8-ce8a721d1bec
https://learnku.com/articles/21227
https://blog.csdn.net/yzl_007/article/details/119363619
https://www.cnblogs.com/blankunbeaten/p/15061041.html
https://zhuanlan.zhihu.com/p/53019744
https://developer.aliyun.com/article/1260385
https://pplsec.github.io/2019/02/16/ThinkPHP5.0Request%E7%B1%BB%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%9020190111/
https://cloud.tencent.com/developer/article/1512631
https://www.exploit-db.com/exploits/45978
https://github.com/vulhub/vulhub/blob/master/thinkphp/5.0.23-rce/README.md
https://www.vulncheck.com/advisories/thinkphp-remote-code-execution-via-invokefunction
https://nvd.nist.gov/vuln/detail/CVE-2018-25270
https://blog.thinkphp.cn/869075